Distributed control system for monitoring a significant control

ABSTRACT

Provided is a control system capable of reducing cost while securing reliability of original processing of a microcomputer. An engine control device and a meter control device each store a control amount calculating procedure for calculating a control amount regarding a significant control to be performed on the control target of the engine control device. The engine control device compares a control amount regarding the significant control calculated by the engine control device, and a control amount regarding the significant control calculated by the meter control device, to thereby control the control target of the engine control device based on a result of the comparison.

CROSS-REFERENCE TO RELATED APPLICATION

This application is a divisional of U.S. application Ser. No. 12/813,102filed Jun. 10, 2010, which is the disclosure of which is incorporatedherein by reference in its entirety.

BACKGROUND OF THE INVENTION

1. Field of the Invention

The present invention relates to a control system including a pluralityof control devices for controlling different subjects, respectively, theplurality of control devices each being connected to a network in whichavailability of transmission is determined based on a communicationstatus at a time of the transmission, and a control system including aplurality of control devices for controlling different subjects,respectively, the plurality of control devices each being connected to anetwork in which time synchronization is possible between nodesconnected thereto.

2. Description of the Related Art

Conventionally, as a control device having high reliability, there hasbeen known such a control device as illustrated in FIG. 16. In FIG. 16,in order to enhance the reliability of control, the control device usestwo identical microcomputers, and executes the control with so-calledmultiplexed microcomputers. In the control device, identical pieces ofdata are input to each of the microcomputers, and, by comparing piecesof data which are output as results of calculations with each other,abnormality detection is performed to enhance the reliability of thecontrol.

However, the above-mentioned control device with the multiplexedmicrocomputers requires two microcomputers having the same function forthe abnormality detection, and hence, there is a problem in that acircuit size thereof becomes larger, resulting in increased cost.

In view of the above, in order to solve the above-mentioned problem,such a control device as illustrated in FIG. 17 is proposed. In FIG. 17,the control device includes a microcomputer and a monitoring circuitspecialized for a monitoring function. Apart from the originalcalculation processing function of the microcomputer, the microcomputeris provided with a calculation processing function for the abnormalitydetection. The monitoring circuit is provided with a calculation circuitsection for executing calculation instructions necessary forimplementing the calculation processing of the microcomputer for theabnormality detection (for example, see JP 3729893 B).

This control device causes the microcomputer and the monitoring circuitto execute identical calculation processing based on identical settingdata, and, by comparing pieces of data output as results ofcalculations, the abnormality detection is performed based on adifference between the results.

With this configuration, without using two microcomputers having thesame function, the abnormality detection can be performed with a smallercircuit size and at lower cost.

However, the related art has the following problems.

The control device disclosed in JP 3729893 B has a problem in thatbecause it is necessary to provide, outside the microcomputer, themonitoring circuit capable of performing the calculation processing forthe abnormality detection with calculation power comparable to that ofthe microcomputer, the cost becomes higher even though the cost is lowercompared to the case where two microcomputers having the same functionare used.

In addition, an abnormality is detected through the calculationprocessing for the abnormality detection, which is different from theoriginal calculation processing that is to be carried out by themicrocomputer. Accordingly, it is possible to perform the abnormalitydetection for the microcomputer itself, but it is impossible to performthe abnormality detection when the microcomputer is executing theoriginal processing of the microcomputer. Hence, the control device alsohas a problem that the reliability of the original processing may not besecured.

SUMMARY OF THE INVENTION

In order to solve the above-mentioned problems, the present inventionhas been made, and has an object to provide a control system capable ofreducing cost while securing reliability of original processing of amicrocomputer.

A control system according to the present invention includes a pluralityof control devices for controlling different control targets,respectively, the plurality of control devices each being connected to anetwork in which availability of transmission is determined based on acommunication status at a time of the transmission. The plurality ofcontrol devices includes a first control device and a second controldevice and subsequent control devices. The first control device and atleast one of the second control device and the subsequent controldevices each store a control amount calculating procedure forcalculating a control amount regarding a significant control having ahigher degree of significance among controls to be performed on thecontrol target of the first control device. The first control devicecompares a control amount regarding the significant control, which iscalculated by the first control device, and a control amount regardingthe significant control, which is calculated by the at least one of thesecond control device and the subsequent control devices, to therebycontrol the control target of the first control device based on a resultof the comparison. When data regarding the significant control istransmitted and received between the first control device and the atleast one of the second control device and the subsequent controldevices, a control device that is to transmit the data regarding thesignificant control transmits the data regarding the significant controlafter suspending the transmission of data from other control devices.

Further, a control system according to the present invention includes aplurality of control devices for controlling different control targets,respectively, the plurality of control devices each being connected to anetwork in which time synchronization is possible between nodesconnected thereto. The plurality of control devices includes a firstcontrol device and a second control device and subsequent controldevices. The first control device and the second control device and thesubsequent control devices each store a control amount calculatingprocedure for calculating a control amount regarding a significantcontrol having a higher degree of significance among controls to beperformed on the control target of the first control device. The firstcontrol device compares a control amount regarding the significantcontrol, which is calculated by the first control device, and a controlamount regarding the significant control, which is calculated, aftersynchronization with the first control device, by one of the secondcontrol device and the subsequent control devices, to thereby controlthe control target of the first control device based on a result of thecomparison.

In the control system according to the present invention, the firstcontrol device and the second control device and the subsequent controldevices are each connected to the network in which the availability ofthe transmission is determined based on the communication status at thetime of the transmission. The first control device and the at least oneof the second control device and the subsequent control devices eachstore the control amount calculating procedure for calculating thecontrol amount regarding the significant control having a higher degreeof significance among the controls to be performed on the control targetof the first control device. The first control device compares thecontrol amount regarding the significant control, which is calculated bythe first control device, and the control amount regarding thesignificant control, which is calculated by the at least one of thesecond control device and the subsequent control devices, to therebycontrol the control target of the first control device based on a resultof the comparison. When the data regarding the significant control istransmitted and received between the first control device and the atleast one of the second control device and the subsequent controldevices, the control device that is to transmit the data regarding thesignificant control transmits the data regarding the significant controlafter suspending the transmission of the data from the other controldevices.

Therefore, without providing two microcomputers having the same functionor the monitoring circuit within the control device and without beingaffected by the network communication status at the time of thetransmission, by comparing and examining the control amount regardingthe significant control, which is calculated by the first controldevice, and the control amount regarding the significant control, whichis calculated by the at least one of the second control device and thesubsequent control devices, it is possible to obtain the control systemcapable of reducing the cost while securing the reliability of theoriginal processing of the microcomputer.

Further, in the control system according to the present invention, thefirst control device and the second control device and the subsequentcontrol devices are each connected to the network in which the timesynchronization is possible between the nodes connected thereto. Thefirst control device and the second control device and the subsequentcontrol devices each store the control amount calculating procedure forcalculating the control amount regarding the significant control havingthe higher degree of significance among the controls to be performed onthe control target of the first control device. The first control devicecompares the control amount regarding the significant control, which iscalculated by the first control device, and the control amount regardingthe significant control, which is calculated, after the synchronizationwith the first control device, by the one of the second control deviceand the subsequent control devices, to thereby control the controltarget of the first control device based on the result of thecomparison.

In other words, without providing two microcomputers having the samefunction or the monitoring circuit within the control device, bycomparing and examining the control amount regarding the significantcontrol, which is calculated by the first control device, and thecontrol amount regarding the significant control, which is calculated bythe one of the second control device and the subsequent control devices,it is possible to obtain the control system capable of reducing the costwhile securing the reliability of the control.

BRIEF DESCRIPTION OF THE DRAWINGS

In the accompanying drawings:

FIG. 1 is a block configuration diagram illustrating a control systemaccording to a first embodiment of the present invention;

FIG. 2 is an explanatory diagram illustrating in detail storage means ofan engine control device of FIG. 1;

FIG. 3 is an explanatory diagram illustrating in detail storage means ofa meter control device of FIG. 1;

FIG. 4 is a timing chart illustrating an operation of the control systemaccording the first embodiment of the present invention;

FIG. 5 is a timing chart illustrating another operation of the controlsystem according the first embodiment of the present invention;

FIG. 6 is a block configuration diagram illustrating a control systemaccording to a second embodiment of the present invention;

FIG. 7 is an explanatory diagram illustrating in detail storage means ofan engine control device of FIG. 6;

FIG. 8 is an explanatory diagram illustrating in detail storage means ofan AT control device of FIG. 6;

FIG. 9 is a timing chart illustrating an operation of the control systemaccording to the second embodiment of the present invention;

FIG. 10 is a block configuration diagram illustrating a control systemaccording to a third embodiment of the present invention;

FIG. 11 is a timing chart illustrating an operation of the controlsystem according the third embodiment of the present invention;

FIG. 12 is a block configuration diagram illustrating a control systemaccording to a fourth embodiment of the present invention;

FIG. 13 is an explanatory diagram illustrating in detail storage meansof an AT control device of FIG. 12;

FIG. 14 is a timing chart illustrating an operation of the controlsystem according to the fourth embodiment of the present invention;

FIG. 15 is a timing chart illustrating an operation of the controlsystem according to a fifth embodiment of the present invention;

FIG. 16 is a block configuration diagram illustrating a conventionalcontrol device; and

FIG. 17 is another block configuration diagram illustrating aconventional control device.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

Hereinbelow, with reference to the drawings, description is given ofpreferred embodiments of a control system according to the presentinvention. In the drawings, like reference numerals and symbols refer toidentical or corresponding elements.

Here, in the following embodiments, description is given of a case wherethe control system is mounted on a vehicle.

First Embodiment

FIG. 1 is a block configuration diagram illustrating a control systemaccording to a first embodiment of the present invention.

In FIG. 1, the control system includes a vehicle-mounted network 10(hereinbelow, referred to as “network 10”), an engine control device 20(first control device) connected to the network 10, and a meter controldevice 30 (second control device). Further, the engine control device 20and the meter control device 30 are connected to an engine unit 200 anda meter unit 300, respectively, which are control targets.

Here, as the network 10, there is employed a CAN network for performingcommunication (hereinbelow, referred to as “CAN communication”)compliant with a controller area network (CAN) protocol (internationalstandard ISO 11898), which adopts a carrier sense multipleaccess/collision avoidance (CSMA/CA) scheme as a method for connectingto a network.

In the CAN network, when linked nodes are not in communication, allnodes can start transmissions, and if the transmissions have occurredsimultaneously, arbitration is conducted based on priorities oftransmission data. In other words, the CAN network is a network in whichavailability of transmission is determined based on a communicationstatus at the time of the transmission. Incidentally, CAN communicationis a well-known technology, and hence detailed description thereof isomitted.

It should be noted that the network is not limited to the networkdescribed above, and another network may be used as long as the networkuses a protocol that adopts the CSMA/CA scheme or a scheme similarthereto as a method for connecting to the network.

Next, description is given of a configuration and functions of theengine control device 20.

The engine control device 20 includes data transmission/reception means21, instruction means for transmission suspension/suspensioncancellation 22 (first instruction means for transmissionsuspension/suspension cancellation), storage means 23 (first storagemeans), data collection means 24, control amount calculation means 25(first control amount calculation means), comparison means 26, andengine control means 27 (control means). Further, the control amountcalculation means 25 is configured by a microcomputer.

Further, apart from the above-mentioned means, the engine control device20 includes other necessary components. However, those components do nothave direct relevance to the first embodiment, and hence descriptionthereof is omitted.

The data transmission/reception means 21 transmits and receives data toand from, via the network 10, other control devices (including the metercontrol device 30) connected to the network 10. The instruction meansfor transmission suspension/suspension cancellation 22 transmits, viathe network 10, an instruction to suspend data transmission or aninstruction to cancel suspension of data transmission to all the othercontrol devices (including the meter control device 30) connected to thenetwork 10. The storage means 23 stores various pieces of data, whichare described below.

The data collection means 24 collects data necessary for engine control(data for first control). The control amount calculation means 25calculates a control amount necessary for the engine control accordingto a processing procedure described below. The comparison means 26compares the control amount calculated by the control amount calculationmeans 25 with a control amount received from the other control devices(including the meter control device 30) connected to the network 10. Theengine control means 27 executes control of the engine unit 200 based onthe calculated control amount.

Next, referring to FIG. 2, detailed description is given of the storagemeans 23 of the engine control device 20.

In FIG. 2, the storage means 23 is divided into a ROM area 230 in whichno other data can be stored apart from previously-stored data and a RAMarea 240 in which data can be stored.

The ROM area 230 contains other ROM data 231, a control amountcalculating procedure for first significant engine control (firstsignificant control) 232 (first control amount calculating procedure), acontrol amount calculating procedure for normal engine control 233, anda free area 234.

Here, the other ROM data 231 and the free area 234 have no directrelevance to the first embodiment, and hence description thereof isomitted.

The control amount calculating procedure for first significant enginecontrol 232 indicates a procedure for calculating a control amountregarding the first significant engine control, whereas the controlamount calculating procedure for normal engine control 233 indicates aprocedure for calculating a control amount regarding the normal enginecontrol.

Here, the first significant engine control refers to such control thatmay endanger the vehicle, the driver, the surroundings of the vehicle,etc. depending on a calculation result, and therefore refers to suchcontrol that requires high reliability.

Further, the RAM area 240 contains other RAM data 241, a free area 242,a storage area for data necessary for calculation 243, and a free area244.

Here, the other RAM data 241, the free area 242, and the free area 244have no direct relevance to the first embodiment, and hence descriptionthereof is omitted.

The storage area for data necessary for calculation 243 is an area inwhich data necessary for calculating a control amount regarding thefirst significant engine control is stored.

Next, referring back to FIG. 1, description is given of a configurationand functions of the meter control device 30.

The meter control device 30 includes data transmission/reception means31, instruction means for transmission suspension/suspensioncancellation 32 (second instruction means for transmissionsuspension/suspension cancellation), storage means 33 (second storagemeans), data saving means 34, control amount calculation means 35(second control amount calculation means), and meter control means 36.Further, the control amount calculation means 35 is configured by amicrocomputer.

Further, apart from the above-mentioned means, the meter control device30 includes other necessary components. However, those components do nothave direct relevance to the first embodiment, and hence descriptionthereof is omitted.

The data transmission/reception means 31 transmits and receives data toand from, via the network 10, other control devices (including theengine control device 20) connected to the network 10. The instructionmeans for transmission suspension/suspension cancellation 32 transmits,via the network 10, an instruction to suspend data transmission or aninstruction to cancel suspension of data transmission to all the othercontrol devices (including the engine control device 20) connected tothe network 10. The storage means 33 stores various pieces of data,which are described below.

The data saving means 34 causes the storage means 33 to store the datanecessary for calculating the control amount regarding the firstsignificant engine control, which is received from the engine controldevice 20. The control amount calculation means 35 calculates a controlamount necessary for the meter control and the engine control accordingto a processing procedure described below. The meter control means 36executes control of the meter unit 300 based on the calculated controlamount.

Next, referring to FIG. 3, detailed description is given of the storagemeans 33 of the meter control device 30.

In FIG. 3, the storage means 33 is divided into a ROM area 330 in whichno other data can be stored apart from previously-stored data and a RAMarea 340 in which data can be stored.

The ROM area 330 contains other ROM data 331, a control amountcalculating procedure for first significant engine control 232, acontrol amount calculating procedure for meter control 333, and a freearea 334.

Here, the other ROM data 331 and the free area 334 have no directrelevance to the first embodiment, and hence description thereof isomitted.

The control amount calculating procedure for first significant enginecontrol 232 indicates a procedure for calculating a control amountregarding the first significant engine control. The storage means 23 andthe storage means 33 each store the same control amount calculatingprocedure for first significant engine control. The control amountcalculating procedure for meter control 333 indicates a procedure forcalculating a control amount regarding the meter control.

Further, the RAM area 340 contains other RAM data 341, a free area 342,a storage area for data necessary for calculation 343, other RAM data344, and a free area 345.

Here, the other RAM data 341, the free area 342, the other RAM data 344,and the free area 345 have no direct relevance to the first embodiment,and hence description thereof is omitted.

The storage area for data necessary for calculation 343 is an area inwhich data necessary for calculating a control amount regarding thefirst significant engine control is stored.

It should be noted that, in FIG. 1, the data transmission/receptionmeans 21 and the data transmission/reception means 31 may be identicalto each other. Similarly, in FIG. 1, the instruction means fortransmission suspension/suspension cancellation 22 and the instructionmeans for transmission suspension/suspension cancellation 32 may beidentical to each other.

Hereinbelow, referring to a timing chart of FIG. 4, description is givenof operation of the control system according to the first embodiment ofthe present invention. Here, description is given of processing relatedto the first significant engine control.

In FIG. 4, the horizontal axes represent engine control device time,which indicates the flow of time in the engine control device 20, andmeter control device time, which indicates the flow of time in the metercontrol device 30.

Further, in FIG. 4, the engine control device 20 executes processing offrom processing 11 to processing 22. Further, the meter control device30 executes processing of from processing 31 to processing 39.

Here, the overall processing of from the processing 11 to the processing22 and from the processing 31 to the processing 39 is processing of afirst significant control stage.

It should be noted that the processing of the first significant controlstage is repeatedly executed every time the processing related to thefirst significant engine control is performed.

Next, description is given of the processing of from the processing 11to the processing 22 performed by the engine control device 20.

In the processing 11, the data collection means 24 collects datanecessary for calculating a control amount regarding the firstsignificant engine control, and then causes the storage means 23 tostore the collected data in the storage area for data necessary forcalculation 243.

In the processing 12, the instruction means for transmissionsuspension/suspension cancellation 22 transmits, via the network 10, aninstruction to suspend data transmission (hereinbelow, referred to as“transmission suspending instruction”) to all the other control devicesconnected to the network 10.

In the processing 13, the data transmission/reception means suspends thetransmission of data irrelevant to the first significant engine controlaccording to the transmission suspending instruction transmitted fromthe instruction means for transmission suspension/suspensioncancellation 22.

In the processing 14, the data transmission/reception means 21transmits, to the meter control device 30, the data necessary forcalculating a control amount regarding the first significant enginecontrol.

In the processing 15, the data transmission/reception means resumes thetransmission of data irrelevant to the first significant engine controlaccording to an instruction to cancel the suspension of datatransmission (hereinbelow, referred to as “suspension cancelinginstruction”), which is received via the network 10 from the instructionmeans for transmission suspension/suspension cancellation 32.

In the processing 16, the control amount calculation means 25 calculatesthe control amount regarding the first significant engine control basedon the data necessary for calculating the control amount regarding thefirst significant engine control and the control amount calculatingprocedure for first significant engine control 232, which are stored inthe storage means 23.

In the processing 17, the data transmission/reception means suspends thetransmission of data irrelevant to the first significant engine controlaccording to the transmission suspending instruction received via thenetwork 10 from the instruction means for transmissionsuspension/suspension cancellation 32.

In the processing 18, the data transmission/reception means 21 receivesa control amount regarding the first significant engine control, whichis transmitted from the meter control device 30.

In the processing 19, the instruction means for transmissionsuspension/suspension cancellation 22 transmits, via the network 10, thesuspension canceling instruction to all the other control devicesconnected to the network 10.

In the processing 20, the data transmission/reception means resumes thetransmission of data irrelevant to the first significant engine controlaccording to the suspension canceling instruction transmitted from theinstruction means for transmission suspension/suspension cancellation22.

In the processing 21, the comparison means 26 compares the controlamount regarding the first significant engine control, which iscalculated in the processing 16, and the control amount regarding thefirst significant engine control, which is received in the processing18. Then, when the two control amounts have the same value, thecomparison means 26 outputs the control amount regarding the firstsignificant engine control to the engine control means 27. When the twocontrol amounts have different values, the comparison means 26 outputsto the engine control means 27 a notification indicating that thecontrol amounts are different.

In the processing 22, the engine control means 27 executes control ofthe engine unit 200 based on a result of the comparison made by thecomparison means 26. Specifically, when the control amount regarding thefirst significant engine control has been input from the comparisonmeans 26, the engine control means 27 executes the control of the engineunit 200 based on this control amount. When the notification indicatingthat the control amounts are different has been input from thecomparison means 26, the engine control means 27 does not execute thecontrol of the engine unit 200.

Next, description is given of the processing of from the processing 31to the processing 39 performed by the meter control device 30.

In the processing 31, the data transmission/reception means suspends thetransmission of data irrelevant to the first significant engine controlaccording to the transmission suspending instruction received via thenetwork 10 from the instruction means for transmissionsuspension/suspension cancellation 22.

In the processing 32, the data transmission/reception means 31 receivesthe data necessary for calculating the control amount regarding thefirst significant engine control, which is transmitted from the enginecontrol device 20. Then, the data saving means 34 causes the storagemeans 33 to store the received data in the storage area for datanecessary for calculation 343.

In the processing 33, the instruction means for transmissionsuspension/suspension cancellation 32 transmits, via the network 10, thesuspension canceling instruction to all the other control devicesconnected to the network 10.

In the processing 34, the data transmission/reception means resumes thetransmission of data irrelevant to the first significant engine controlaccording to the suspension canceling instruction transmitted from theinstruction means for transmission suspension/suspension cancellation32.

In the processing 35, the control amount calculation means 35 calculatesthe control amount regarding the first significant engine control basedon the data necessary for calculating the control amount regarding thefirst significant engine control, and the control amount calculatingprocedure for first significant engine control 232, which are stored inthe storage means 33.

In the processing 36, the instruction means for transmissionsuspension/suspension cancellation 32 transmits, via the network 10, thetransmission suspending instruction to all the other control devicesconnected to the network 10.

In the processing 37, the data transmission/reception means suspends thetransmission of data irrelevant to the first significant engine controlaccording to the transmission suspending instruction transmitted fromthe instruction means for transmission suspension/suspensioncancellation 32.

In the processing 38, the data transmission/reception means 31transmits, to the engine control device 20, the control amount regardingthe first significant engine control, which is calculated in theprocessing 35.

In the processing 39, the data transmission/reception means 31 resumesthe transmission of data irrelevant to the first significant enginecontrol according to the suspension canceling instruction received viathe network 10 from the instruction means for transmissionsuspension/suspension cancellation 22.

Here, the processing 16 of the engine control device 20 and theprocessing 35 of the meter control device 30 are started at a timingwhen a predetermined period of time has elapsed after reception of thesuspension canceling instructions in the processing and the processing34, respectively. In this manner, by synchronizing the timings with eachother, it is possible to execute the processing 16 and the processing 35at the same timing.

In the timing chart illustrated in FIG. 4, only the processing relatedto the first significant engine control is illustrated for the purposeof clarifying the features of the first embodiment. However, inactuality, not only this processing, there exist processing related tothe normal engine control and processing related to the meter control inthe engine control device 20 and in the meter control device 30,respectively. These processings are executed in each of the controldevices during the time in which the processing related to the firstsignificant engine control is not executed.

Next, referring to the timing chart of FIG. 4, description is given ofoperation of the control system, which is performed in a case wherethere is no abnormality in both of the control amount calculation means25 and the control amount calculation means 35, enabling the controlamounts regarding the first significant engine control to be calculatedaccurately.

First, at a time point t1, the data collection means 24 executes theprocessing 11 to cause the storage means 23 to store the data necessaryfor calculating the control amount regarding the first significantengine control in the storage area for data necessary for calculation243.

Next, at a time point t2, the instruction means for transmissionsuspension/suspension cancellation 22 executes the processing 12 totransmit, via the network 10, the transmission suspending instruction toall the other control devices connected to the network 10.

Next, at a time point t3, the data transmission/reception means 21 andthe data transmission/reception means 31 simultaneously execute theprocessing 13 and the processing 31, respectively, to suspend thetransmission of data irrelevant to the first significant engine controlaccording to the transmission suspending instruction transmitted fromthe instruction means for transmission suspension/suspensioncancellation 22.

Next, at a time point t4, the data transmission/reception means 21executes the processing 14 to transmit, via the network 10, the datanecessary for calculating the control amount regarding the firstsignificant engine control to the meter control device 30.

Next, at a time point t5, the data transmission/reception means 31 andthe data saving means 34 execute the processing 32 to cause the storagemeans 33 to store, in the storage area for data necessary forcalculation 343, the received data necessary for calculating the controlamount regarding the first significant engine control.

Next, at a time point t6, the instruction means for transmissionsuspension/suspension cancellation 32 executes the processing 33 totransmit, via the network 10, the suspension canceling instruction toall the other control devices connected to the network 10.

Next, at a time point t7, the data transmission/reception means 21 andthe data transmission/reception means 31 simultaneously execute theprocessing 15 and the processing 34, respectively, to resume thetransmission of data irrelevant to the first significant engine controlaccording to the suspension canceling instruction transmitted from theinstruction means for transmission suspension/suspension cancellation32.

Next, at a time point t8, by using the above-mentioned method ofsynchronizing the timings with each other, the control amountcalculation means 25 and the control amount calculation means 35simultaneously execute the processing 16 and the processing 35,respectively. The control amount calculation means 25 and the controlamount calculation means 35 calculate control amounts regarding thefirst significant engine control based on the control amount calculatingprocedure for first significant engine control 232 and the respectivepieces of data necessary for calculating the control amount regardingthe first significant engine control, which are stored in the storagemeans 23 and the storage means 33.

Next, at a time point t9, the instruction means for transmissionsuspension/suspension cancellation 32 executes the processing 36 totransmit, via the network 10, the transmission suspending instruction toall the other control devices connected to the network 10.

Next, at a time point t10, the data transmission/reception means 21 andthe data transmission/reception means 31 simultaneously execute theprocessing 17 and the processing 37, respectively, to suspend thetransmission of data irrelevant to the first significant engine controlaccording to the transmission suspending instruction transmitted fromthe instruction means for transmission suspension/suspensioncancellation 32.

Next, at a time point t11, the data transmission/reception means 31executes the processing 38 to transmit the control amount regarding thefirst significant engine control, which is calculated in the processing35, to the engine control device 20 via the network 10.

Next, at a time point t12, the data transmission/reception means 21executes the processing 18 to receive the control amount regarding thefirst significant engine control, which is transmitted via the network10 from the meter control device 30.

Next, at a time point t13, the instruction means for transmissionsuspension/suspension cancellation 22 executes the processing 19 totransmit, via the network 10, the suspension canceling instruction toall the other control devices connected to the network 10.

Next, at a time point t14, the data transmission/reception means 21 andthe data transmission/reception means 31 simultaneously execute theprocessing 20 and the processing 39, respectively, to resume thetransmission of data irrelevant to the first significant engine controlaccording to the suspension canceling instruction transmitted from theinstruction means for transmission suspension/suspension cancellation22.

Next, at a time point t15, the comparison means 26 executes theprocessing 21 to compare the control amount regarding the firstsignificant engine control, which is calculated in the processing 16,and the control amount regarding the first significant engine control,which is received in the processing 18. Here, because there is noabnormality in both of the control amount calculation means 25 and thecontrol amount calculation means 35, the control amounts regarding thefirst significant engine control have the same value. Accordingly, thecomparison means 26 outputs the control amount regarding the firstsignificant engine control to the engine control means 27.

Next, at a time point t16, the engine control means 27 executes theprocessing 22 to execute the control of the engine unit 200 based on thecontrol amount regarding the first significant engine control, which hasbeen input from the comparison means 26.

Next, referring to the timing chart of FIG. 4, description is given ofoperation of the control system, which is performed in a case wherethere is an abnormality in any one of the control amount calculationmeans 25 and the control amount calculation means 35.

It should be noted that because the processing from the time point t1 tothe time point t7 of the first significant control stage is the same asthe above-mentioned processing performed in a case where there is noabnormality in the control amount calculation means 25 and the controlamount calculation means 35, description thereof is omitted.

First, at the time point t8, the control amount calculation means 25 andthe control amount calculation means 35 simultaneously execute theprocessing 16 and the processing 35, respectively. The control amountcalculation means 25 calculates the control amount regarding the firstsignificant engine control based on the data necessary for calculatingthe control amount regarding the first significant engine control andthe control amount calculating procedure for first significant enginecontrol 232, which are stored in the storage means 23. Here, forexample, if there is an abnormality in the control amount calculationmeans 25, the calculated control amount regarding the first significantengine control has a different value from the control amount that is tobe obtained originally.

On the other hand, the control amount calculation means 35 calculatesthe control amount regarding the first significant engine control basedon the data necessary for calculating the control amount regarding thefirst significant engine control and the control amount calculatingprocedure for first significant engine control 232, which are stored inthe storage means 33.

Further, the processing from the time point t9 to the time point t14 ofthe first significant control stage is also the same as theabove-mentioned processing performed in a case where there is noabnormality in the control amount calculation means 25 and the controlamount calculation means 35, and hence description thereof is omitted.

Next, at the time point t15, the comparison means 26 executes theprocessing 21 to compare the control amount regarding the firstsignificant engine control, which is calculated in the processing 16,and the control amount regarding the first significant engine control,which is received in the processing 18. Here, because there is anabnormality in the control amount calculation means 25, the controlamounts regarding the first significant engine control have differentvalues. Accordingly, the comparison means 26 outputs to the enginecontrol means 27 the notification indicating that the control amountsare different.

Next, at the time point t16, the engine control means 27 executes theprocessing 22. However, due to input of the notification indicating thatthe control amounts are different from the comparison means 26, theengine control means 27 does not execute the control of the engine unit200.

In this manner, by comparing and examining is made between the controlamount regarding the first significant engine control, which iscalculated by the control amount calculation means 25, and the controlamount regarding the first significant engine control, which iscalculated by the control amount calculation means 35, it is possible todetect whether or not there is an abnormality in any one of the controlamount calculation means 25 and the control amount calculation means 35.

Specifically, by comparing the control amount regarding the firstsignificant engine control, which is calculated by the control amountcalculation means 25, and the control amount regarding the firstsignificant engine control, which is calculated by the control amountcalculation means 35, and, when the two control amounts have the samevalue, executing the control of the engine unit 200 based on thatcontrol amount regarding the first significant engine control, it ispossible to reduce the cost of the control system while securingreliability of the control without providing two microcomputers or amonitoring circuit within the engine control device 20 and without beingaffected by the network communication status at the time oftransmission.

Further, while the control amount regarding the first significant enginecontrol is being calculated in the engine control device 20 (originalcalculation), the corresponding control amount is calculated by thecontrol amount calculation means 35 of the meter control device 30, tothereby compare results of the calculations. Then, when both of thecontrol amounts have the same value, the control of the engine unit 200is executed based on the control amounts regarding the first significantengine control. As a result, at the time of carrying out not thecalculation for the abnormality detection but the original calculation,it is possible to judge whether or not there is an abnormality, therebysecuring the reliability of the control.

In addition, while the control amount regarding the first significantengine control is being calculated in the engine control device 20, thecorresponding control amount is simultaneously calculated by the controlamount calculation means 35 of the meter control device 30.Consequently, comparison between the calculation results can be made assoon as possible, and hence it is also possible to reduce a processingtime required for the first significant engine control.

As described above, according to the first embodiment, there areprovided a first control device and a second control device, which areconnected to a network in which availability of transmission isdetermined based on a communication status at the time of thetransmission. The first control device includes: a first control amountcalculation means for calculating a control amount regarding a firstsignificant control based on a first control amount calculatingprocedure for calculating the control amount regarding the firstsignificant control, and data for first control necessary forcalculating the control amount regarding the first significant controlfor the control target of the first control device; comparison means forcomparing the control amount regarding the first significant control,which is calculated by the first control amount calculation means, andthe control amount regarding the first significant control, which iscalculated by the second control device; control means for controllingthe control target based on a result of the comparison made by thecomparison means; and a first instruction means for transmissionsuspension/suspension cancellation for transmitting, to all the othercontrol devices connected to the network, one of a transmissionsuspending instruction and a suspension canceling instruction. Further,the second control device includes: a second storage means for storingthe first control amount calculating procedure and the data for firstcontrol, which is received from the first control device via thenetwork; a second control amount calculation means for calculating thecontrol amount regarding the first significant control based on thefirst control amount calculating procedure and the data for firstcontrol; and a second instruction means for transmissionsuspension/suspension cancellation for transmitting, to all the othercontrol devices connected to the network, one of the transmissionsuspending instruction and the suspension canceling instruction.

Therefore, without providing two microcomputers having the samefunctions or a monitoring circuit within the control device and withoutbeing affected by the network communication status at the time oftransmission, by comparing and examining the control amount regardingthe first significant control, which is calculated by the first controlamount calculation means, and the control amount regarding the firstsignificant control, which is calculated by the second control device,it is possible to obtain a control system capable of reducing the costwhile securing the reliability of the control.

Further, when the comparison means judges that all of the comparedcontrol amounts regarding the first significant control have the samevalues, the control means controls the control target based on thecontrol amounts regarding the first significant control having the samevalue. When the comparison means judges that not all of the comparedcontrol amounts regarding the first significant control have the samevalues, the control means does not control the control target.Therefore, the reliability of the control can be improved.

Here, in the first embodiment described above, there has been given thedescription in which, when the notification indicating that the controlamounts are different has been input from the comparison means 26, theengine control means 27 does not execute the control of the engine unit200. However, the present invention is not limited thereto. When thenotification indicating that the control amounts are different has beeninput from the comparison means 26, the engine control means 27 mayexecute the control of the engine unit 200 based on a predeterminedcontrol amount previously set as a control amount regarding the firstsignificant engine control. Further, instead of the predeterminedcontrol amount, the engine control means 27 may use the control amountcalculated last time.

In this case, even if an abnormality has occurred in any one of thecontrol amount calculation means 25 and the control amount calculationmeans 35, it is possible to continue the control without stopping theengine.

Further, in the first embodiment described above, there has been giventhe description in which the timings at which the processing 16 of theengine control device 20 and the processing 35 of the meter controldevice 30 are started are synchronized with each other. However, even ifa time lag has occurred in the processing start due to the timings thatare not synchronized with each other, this does not inflict asignificant adverse effect on an object of the present invention, whichis to improve the reliability of the control.

Further, in the first embodiment described above, the control amountcalculation means 25 and the control amount calculation means 35 mayhave an identical configuration by, for example, using microcomputers ofthe same model number from the same manufacturer.

In this case, the control amounts can be calculated more accurately. Inaddition, by executing the control of the engine unit 200 based on aresult obtained through comparison between such control amounts, it ispossible to improve the reliability of the control.

Further, in the first embodiment described above, the storage means 23and the storage means 33 may have an identical configuration by, forexample, using memories of the same model number from the samemanufacturer. Then, the control amount calculating procedure for firstsignificant engine control 232 may be stored at the same location ofeach of the memories.

In this case, the control amounts can be calculated more accurately. Inaddition, by executing the control of the engine unit 200 based on aresult obtained through comparison among such control amounts, it ispossible to improve the reliability of the control.

Further, in the first embodiment described above, the storage means 23and the storage means 33 may have an identical configuration by, forexample, using memories of the same model number from the samemanufacturer. Then, the storage area for data necessary for calculation243 and the storage area for data necessary for calculation 343, inwhich data necessary for calculating a control amount regarding thefirst significant engine control is stored, may be located at the samelocation of each of the memories.

In this case, the control amounts can be calculated more accurately. Inaddition, by executing the control of the engine unit 200 based on aresult obtained through comparison among such control amounts, it ispossible to improve the reliability of the control.

Further, in the first embodiment described above, there has been giventhe description of the case where an abnormality occurs in the controlamount calculation means 25. According to the first embodiment, even ifunintended data change, data corruption, or the like has occurred afterthe data necessary for calculating a control amount regarding the firstsignificant engine control is transmitted to the meter control device 30by the data transmission/reception means 21, it is possible to improvethe reliability of the control by executing the control of the engineunit 200 based on a result obtained through comparison among thecalculated control amounts.

Further, in the first embodiment described above, the description hasbeen given by taking as an example a case where two control devices areprovided, but the present invention is not limited thereto. The sameeffect can be obtained even if three or more control devices calculatecontrol amounts regarding the first significant engine control to makecomparison among the calculated control amounts.

Further, in the first embodiment described above, there has been giventhe description in which, when the transmission suspending instructionis transmitted from the instruction means for transmissionsuspension/suspension cancellation 22, the instruction means fortransmission suspension/suspension cancellation 32 transmits thesuspension canceling instruction, and when the transmission suspendinginstruction is transmitted from the instruction means for transmissionsuspension/suspension cancellation 32, the instruction means fortransmission suspension/suspension cancellation 22 transmits thesuspension canceling instruction. In other words, the suspensioncanceling instruction is transmitted by the instruction means fortransmission suspension/suspension cancellation of the control devicethat has received the data regarding the first significant enginecontrol.

However, the present invention is not limited thereto. For example, whena predetermined period of time elapses after the transmission suspendinginstruction has been transmitted from the instruction means fortransmission suspension/suspension cancellation 22, the instructionmeans for transmission suspension/suspension cancellation 22 maytransmit the suspension canceling instruction. Alternatively, when apredetermined period of time elapses after the transmission suspendinginstruction has been transmitted from the instruction means fortransmission suspension/suspension cancellation 32, the instructionmeans for transmission suspension/suspension cancellation 32 maytransmit the suspension canceling instruction. In such cases, thepredetermined period of time has a time length long enough to judge thatthe data regarding the first significant engine control has beenreceived on the reception side without fail.

Hereinbelow, referring to a timing chart of FIG. 5, description is givenof operation of the control system, which is performed in a case wherethe instruction means for transmission suspension/suspensioncancellation that transmitted the transmission suspending instructiontransmits the suspension canceling instruction after the predeterminedperiod of time has elapsed.

In the timing chart illustrated in FIG. 5, instead of the processing 33illustrated in FIG. 4 performed by the meter control device 30, theengine control device 20 executes processing 23. Further, instead of theprocessing 19 performed by the meter control device 30, the enginecontrol device 20 executes processing 40.

In the processing 23, the instruction means for transmissionsuspension/suspension cancellation 22 transmits, via the network 10, thesuspension canceling instruction to all the other control devicesconnected to the network 10.

In the processing 40, the instruction means for transmissionsuspension/suspension cancellation 32 transmits, via the network 10, thesuspension canceling instruction to all the other control devicesconnected to the network 10.

Further, in the timing chart illustrated in FIG. 5, processing from atime point t21 to a time point t36 of the first significant controlstage is the same as the processing from the time point t1 to the timepoint t16 of the timing chart illustrated in FIG. 4 except forprocessing of a time point 26 and a time point 33, and hence descriptionthereof is omitted.

At a time point t26, the instruction means for transmissionsuspension/suspension cancellation 22 executes the processing 23 totransmit, via the network 10, the suspension canceling instruction toall the other control devices connected to the network 10.

Further, at a time point t33, the instruction means for transmissionsuspension/suspension cancellation 32 executes the processing 40 totransmit, via the network 10, the suspension canceling instruction toall the other control devices connected to the network 10.

In this manner, with the configuration in which the suspension cancelinginstruction is transmitted by the instruction means for transmissionsuspension/suspension cancellation of the control device that hastransmitted the data regarding the first significant engine control, thesame effect as in the first embodiment described above can be obtained.Further, even if the instruction means for transmissionsuspension/suspension cancellation on the reception side is in a stateof not being able to cancel the suspension of data transmission due to afailure or the like, the instruction means for transmissionsuspension/suspension cancellation on the transmission side can cancelthe suspension of transmission by transmitting the suspension cancelinginstruction after the predetermined period of time has elapsed.Consequently, it is possible to reduce an adverse effect on the entirenetwork, which is caused by continuation of the transmission suspension.

Second Embodiment

In the first embodiment described above, two or more control devicescalculate control amounts regarding the first significant engine controlto compare the calculated control amounts. However, the presentinvention is not limited thereto. Two or more control devices may eachcalculate control amounts regarding two or more significant controls tocompare the calculated control amounts.

Hereinbelow, description is given by taking as an example a case wheretwo control devices each calculate control amounts regarding twosignificant controls to compare the calculated control amounts.

FIG. 6 is a block configuration diagram illustrating a control systemaccording to a second embodiment of the present invention.

In FIG. 6, in addition to the control system illustrated in FIG. 1, thecontrol system according to the second embodiment includes an automatictransmission (AT) control device 40 (third control device) connected tothe network 10. Further, the AT control device 40 is connected to an ATunit 400, which is a control target.

Next, description is given of a configuration and functions of the ATcontrol device 40.

The AT control device 40 includes data transmission/reception means 41,instruction means for transmission suspension/suspension cancellation 42(third instruction means for transmission suspension/suspensioncancellation), storage means 43 (third storage means), data saving means44, control amount calculation means 45 (third control amountcalculation means), and AT control means 46. Further, the control amountcalculation means 45 is configured by a microcomputer.

Further, apart from the above-mentioned means, the AT control device 40includes other necessary components. However, those components do nothave direct relevance to the second embodiment, and hence descriptionthereof is omitted.

The data transmission/reception means 41 transmits and receives data toand from, via the network 10, other control devices (including theengine control device 20 and the meter control device 30) connected tothe network 10. The instruction means for transmissionsuspension/suspension cancellation 42 transmits, via the network 10, aninstruction to suspend data transmission or an instruction to cancelsuspension of data transmission to all the other control devices(including the engine control device 20 and the meter control device 30)connected to the network 10. The storage means 43 stores various piecesof data, which are described below.

The data saving means 44 causes the storage means 43 to store datanecessary for calculating a control amount regarding a secondsignificant engine control (second significant control), which isreceived from the engine control device 20. The control amountcalculation means 45 calculates control amounts necessary for the ATcontrol and the engine control based on a processing procedure describedbelow. The AT control means 46 executes control of the AT unit 400 basedon the calculated control amount.

Next, referring to FIG. 7, detailed description is given of the storagemeans 23 of the engine control device 20. Here, for the configurationsimilar to that of the first embodiment illustrated in FIG. 2,description thereof is omitted.

In FIG. 7, the ROM area 230 of the storage means 23 contains the otherROM data 231, the control amount calculating procedure for firstsignificant engine control 232, the control amount calculating procedurefor normal engine control 233, and a control amount calculatingprocedure for second significant engine control 235 (second controlamount calculating procedure).

The control amount calculating procedure for second significant enginecontrol 235 indicates a procedure for calculating a control amountregarding the second significant engine control, and indicates aprocedure that is different from the procedure indicated by the controlamount calculating procedure for first significant engine control 232.

Here, the second significant engine control refers to such control thatmay endanger the vehicle, the driver, the surroundings of the vehicle,etc. depending on a calculation result, and therefore refers to suchcontrol that requires high reliability.

Next, referring to FIG. 8, detailed description is given of the storagemeans 43 of the AT control device 40.

In FIG. 8, the storage means 43 is divided into a ROM area 430 in whichno other data can be stored apart from previously-stored data and a RAMarea 440 in which data can be stored.

The ROM area 430 contains other ROM data 431, a control amountcalculating procedure for AT control 433, a free area 434, and theamount calculating procedure for second significant engine control 235.

Here, the other ROM data 431 and the free area 434 have no directrelevance to the second embodiment, and hence description thereof isomitted.

The control amount calculating procedure for AT control 433 indicates aprocedure for calculating a control amount regarding the AT control.

The control amount calculating procedure for second significant enginecontrol 235 indicates a procedure for calculating a control amountregarding the second significant engine control, and the storage means23 and the storage means 43 each store the same control amountcalculating procedure for second significant engine control 235.

Further, the RAM area 440 contains other RAM data 441, a free area 442,a storage area for data necessary for calculation 443, other RAM data444, and a free area 445.

Here, the other RAM data 441, the free area 442, the other RAM data 444,and the free area 445 have no direct relevance to the second embodiment,and hence description thereof is omitted.

The storage area for data necessary for calculation 443 is an area inwhich data necessary for calculating a control amount regarding thesecond significant engine control is stored.

It should be noted that, in FIG. 6, the data transmission/receptionmeans 21, the data transmission/reception means 31, and the datatransmission/reception means 41 may be identical to one another.Similarly, in FIG. 6, the instruction means for transmissionsuspension/suspension cancellation 22, the instruction means fortransmission suspension/suspension cancellation 32, and the instructionmeans for transmission suspension/suspension cancellation 42 may beidentical to one another.

Further, the rest of the configuration and the functions are the same asin the first embodiment, and hence description thereof is omitted.

Hereinbelow, referring to a timing chart of FIG. 9, description is givenof operation of the control system according to the second embodiment ofthe present invention. Here, description is given of processing relatedto the first significant engine control and the second significantengine control.

In FIG. 9, the horizontal axes represent engine control device time,which indicates the flow of time in the engine control device 20, metercontrol device time, which indicates the flow of time in the metercontrol device 30, and AT control device time, which indicates the flowof time in the AT control device 40.

Further, in FIG. 9, the engine control device 20 executes, in additionto the processing of from the processing 11 to the processing 22illustrated in FIG. 4, processing of from processing 51 to processing62. Further, the meter control device 30 executes, in addition to theprocessing of from the processing 31 to the processing 39 illustrated inFIG. 4, processing of from processing 71 to processing 74. Further, theAT control device 40 executes processing of from processing 41 toprocessing 44 and from processing 81 to processing 89.

Here, the rest of the processing is the same as in the first embodiment,and hence description thereof is omitted.

Here, the processing of from the processing 11 to the processing 22,from the processing 31 to the processing 39, and from the processing 41to the processing 44 is processing of the first significant controlstage. On the other hand, the processing of from the processing 51 tothe processing 62, from the processing 71 to the processing 74, and fromthe processing 81 to the processing 89 is processing of a secondsignificant control stage.

It should be noted that the processing of the first significant controlstage is repeatedly executed every time the processing related to thefirst significant engine control is performed, and that processing ofthe second significant control stage is repeatedly executed every timethe processing related to the second significant engine control isperformed.

Next, description is given of the processing of from the processing 41to the processing 44 performed by the AT control device 40.

In the processing 41, the data transmission/reception means 41 suspendstransmission of data irrelevant to the first significant engine controlaccording to the transmission suspending instruction received via thenetwork 10 from the instruction means for transmissionsuspension/suspension cancellation 22.

In the processing 42, the data transmission/reception means resumes thetransmission of data irrelevant to the first significant engine controlaccording to the suspension canceling instruction received via thenetwork 10 from the instruction means for transmissionsuspension/suspension cancellation 32.

In the processing 43, the data transmission/reception means suspends thetransmission of data irrelevant to the first significant engine controlaccording to the transmission suspending instruction received via thenetwork 10 from the instruction means for transmissionsuspension/suspension cancellation 32.

In the processing 44, the data transmission/reception means resumes thetransmission of data irrelevant to the first significant engine controlaccording to the suspension canceling instruction received via thenetwork 10 from the instruction means for transmissionsuspension/suspension cancellation 22.

Next, description is given of the processing of from the processing 51to the processing 62 performed by the engine control device 20.

In the processing 51, the data collection means 24 collects datanecessary for calculating a control amount regarding the secondsignificant engine control (data for second control), and then causesthe storage means 23 to store the collected data in the storage area fordata necessary for calculation 243.

In the processing 52, the instruction means for transmissionsuspension/suspension cancellation 22 transmits, via the network 10, thetransmission suspending instruction to all the other control devicesconnected to the network 10.

In the processing 53, the data transmission/reception means 21 suspendsthe transmission of data irrelevant to the second significant enginecontrol according to the transmission suspending instruction transmittedfrom the instruction means for transmission suspension/suspensioncancellation 22.

In the processing 54, the data transmission/reception means 21transmits, to the AT control device 40, the data necessary forcalculating a control amount regarding the second significant enginecontrol.

In the processing 55, the data transmission/reception means 21 resumesthe transmission of the data irrelevant to the second significant enginecontrol according to the suspension canceling instruction that isreceived via the network 10 from the instruction means for transmissionsuspension/suspension cancellation 42.

In the processing 56, the control amount calculation means 25 calculatesthe control amount regarding the second significant engine control basedon the data necessary for calculating the control amount regarding thesecond significant engine control and the control amount calculatingprocedure for second significant engine control 235, which are stored inthe storage means 23.

In the processing 57, the data transmission/reception means 21 suspendsthe transmission of data irrelevant to the second significant enginecontrol according to the transmission suspending instruction receivedvia the network 10 from the instruction means for transmissionsuspension/suspension cancellation 42.

In the processing 58, the data transmission/reception means 21 receivesa control amount regarding the second significant engine control, whichis transmitted from the AT control device 40.

In the processing 59, the instruction means for transmissionsuspension/suspension cancellation 22 transmits, via the network 10, thesuspension canceling instruction to all the other control devicesconnected to the network 10.

In the processing 60, the data transmission/reception means 21 resumesthe transmission of data irrelevant to the second significant enginecontrol according to the suspension canceling instruction transmittedfrom the instruction means for transmission suspension/suspensioncancellation 22.

In the processing 61, the comparison means 26 compares the controlamount regarding the second significant engine control, which iscalculated in the processing 56, and the control amount regarding thesecond significant engine control, which is received in the processing58. Then, when the two control amounts have the same value, thecomparison means 26 outputs the control amount regarding the secondsignificant engine control to the engine control means 27. When the twocontrol amounts have different values, the comparison means 26 outputsto the engine control means 27 a notification indicating that thecontrol amounts are different.

In the processing 62, the engine control means 27 executes control ofthe engine unit 200 based on a result of the comparison made by thecomparison means 26. Specifically, when the control amount regarding thesecond significant engine control has been input from the comparisonmeans 26, the engine control means 27 executes the control of the engineunit 200 based on this control amount. When the notification indicatingthat the control amounts are different has been input from thecomparison means 26, the engine control means 27 does not execute thecontrol of the engine unit 200.

Next, description is given of the processing of from the processing 71to the processing 74 performed by the meter control device 30.

In the processing 71, the data transmission/reception means 31 suspendsthe transmission of data irrelevant to the second significant enginecontrol according to the transmission suspending instruction receivedvia the network 10 from the instruction means for transmissionsuspension/suspension cancellation 22.

In the processing 72, the data transmission/reception means 31 resumesthe transmission of data irrelevant to the second significant enginecontrol according to the suspension canceling instruction received, viathe network 10, from the instruction means for transmissionsuspension/suspension cancellation 42.

In the processing 73, the data transmission/reception means 31 suspendsthe transmission of data irrelevant to the second significant enginecontrol according to the transmission suspending instruction received,via the network 10, from the instruction means for transmissionsuspension/suspension cancellation 42.

In the processing 74, the data transmission/reception means 31 resumesthe transmission of data irrelevant to the second significant enginecontrol according to the suspension canceling instruction received, viathe network 10, from the instruction means for transmissionsuspension/suspension cancellation 22.

Next, description is given of the processing of from the processing 81to the processing 89 performed by the AT control device 40.

In the processing 81, the data transmission/reception means 41 suspendsthe transmission of data irrelevant to the second significant enginecontrol according to the transmission suspending instruction received,via the network 10, from the instruction means for transmissionsuspension/suspension cancellation 22.

In the processing 82, the data transmission/reception means 41 receivesthe data necessary for calculating the control amount regarding thesecond significant engine control, which is transmitted from the enginecontrol device 20. Then, the data saving means 44 causes the storagemeans 43 to store the received data in the storage area for datanecessary for calculation 443.

In the processing 83, the instruction means for transmissionsuspension/suspension cancellation 42 transmits, via the network 10, thesuspension canceling instruction to all the other control devicesconnected to the network 10.

In the processing 84, the data transmission/reception means 41 resumesthe transmission of data irrelevant to the second significant enginecontrol according to the suspension canceling instruction transmittedfrom the instruction means for transmission suspension/suspensioncancellation 42.

In the processing 85, the control amount calculation means 45 calculatesthe control amount regarding the second significant engine control basedon the data necessary for calculating the control amount regarding thesecond significant engine control, and the control amount calculatingprocedure for second significant engine control 235, which are stored inthe storage means 43.

In the processing 86, the instruction means for transmissionsuspension/suspension cancellation 42 transmits, via the network 10, thetransmission suspending instruction to all the other control devicesconnected to the network 10.

In the processing 87, the data transmission/reception means 41 suspendsthe transmission of data irrelevant to the second significant enginecontrol according to the transmission suspending instruction transmittedfrom the instruction means for transmission suspension/suspensioncancellation 42.

In the processing 88, the data transmission/reception means 41transmits, to the engine control device 20, the control amount regardingthe second significant engine control, which is calculated in theprocessing 85.

In the processing 89, the data transmission/reception means 41 resumesthe transmission of data irrelevant to the second significant enginecontrol according to the suspension canceling instruction received viathe network 10 from the instruction means for transmissionsuspension/suspension cancellation 22.

Here, the processing 16 of the engine control device 20 and theprocessing 35 of the meter control device 30 are started at a timingwhen a predetermined period of time has elapsed after reception of thesuspension canceling instructions in the processing and the processing34, respectively. In this manner, by synchronizing the timings with eachother, it is possible to execute the processing 16 and the processing 35at the same timing.

Further, the processing 56 of the engine control device 20 and theprocessing 85 of the AT control device 40 are started at a timing when apredetermined period of time has elapsed after reception of thesuspension canceling instructions in the processing and the processing84, respectively. In this manner, by synchronizing the timings with eachother, it is possible to execute the processing 56 and the processing 85at the same timing.

In the timing chart illustrated in FIG. 9, only the processing relatedto the first significant engine control and the processing related tothe second significant engine control are illustrated for the purpose ofclarifying the features of the second embodiment. However, in actuality,not only these processings, there exist processing related to the normalengine control, processing related to the meter control and processingrelated to the AT control in the engine control device 20, in the metercontrol device 30, and in the AT control device 40, respectively. Theseprocessings are executed in each of the control devices during the freetime in which the processing related to the first significant enginecontrol (processing of the first significant control stage andprocessing of the second significant control stage illustrated in FIG.9) is not executed.

Next, referring to the timing chart of FIG. 9, description is given ofoperation of the control system, which is performed in a case wherethere is no abnormality in the control amount calculation means 25, thecontrol amount calculation means 35, and the control amount calculationmeans 45, enabling the control amount regarding the first significantengine control and the control amount regarding the second significantengine control to be calculated accurately.

First of all, description is given of the processing of the firstsignificant control stage.

First, at a time point t41, the data collection means 24 executes theprocessing 11 to cause the storage means 23 to store the data necessaryfor calculating the control amount regarding the first significantengine control in the storage area for data necessary for calculation243.

Next, at a time point t42, the instruction means for transmissionsuspension/suspension cancellation 22 executes the processing 12 totransmit, via the network 10, the transmission suspending instruction toall the other control devices connected to the network 10.

Next, at a time point t43, the data transmission/reception means 21, thedata transmission/reception means 31, and the datatransmission/reception means 41 simultaneously execute the processing13, the processing 31, and the processing 41, respectively, to suspendthe transmission of data irrelevant to the first significant enginecontrol according to the transmission suspending instruction transmittedfrom the instruction means for transmission suspension/suspensioncancellation 22.

Next, at a time point t44, the data transmission/reception means 21executes the processing 14 to transmit, via the network 10, the datanecessary for calculating the control amount regarding the firstsignificant engine control to the meter control device 30.

Next, at a time point t45, the data transmission/reception means 31 andthe data saving means 34 execute the processing 32 to cause the storagemeans 33 to store, in the storage area for data necessary forcalculation 343, the received data necessary for calculating the controlamount regarding the first significant engine control.

Next, at a time point t46, the instruction means for transmissionsuspension/suspension cancellation 32 executes the processing 33 totransmit, via the network 10, the suspension canceling instruction toall the other control devices connected to the network 10.

Next, at a time point t47, the data transmission/reception means 21, thedata transmission/reception means 31, and the datatransmission/reception means 41 simultaneously execute the processing15, the processing 34, and the processing 42, respectively, to resumethe transmission of data irrelevant to the first significant enginecontrol according to the suspension canceling instruction transmittedfrom the instruction means for transmission suspension/suspensioncancellation 32.

Next, at a time point t48, by using the above-mentioned method ofsynchronizing the timings with each other, the control amountcalculation means 25 and the control amount calculation means 35simultaneously execute the processing 16 and the processing 35,respectively. The control amount calculation means 25 and the controlamount calculation means 35 calculate control amounts regarding thefirst significant engine control based on the control amount calculatingprocedure for first significant engine control 232 and the respectivepieces of data necessary for calculating the control amount regardingthe first significant engine control, which are stored in the storagemeans 23 and the storage means 33.

Next, at a time point t49, the instruction means for transmissionsuspension/suspension cancellation 32 executes the processing 36 totransmit, via the network 10, the transmission suspending instruction toall the other control devices connected to the network 10.

Next, at a time point t50, the data transmission/reception means 21, thedata transmission/reception means 31, and the datatransmission/reception means 41 simultaneously execute the processing17, the processing 37, and the processing 43, respectively, to suspendthe transmission of data irrelevant to the first significant enginecontrol according to the transmission suspending instruction transmittedfrom the instruction means for transmission suspension/suspensioncancellation 32.

Next, at a time point t51, the data transmission/reception means 31executes the processing 38 to transmit the control amount regarding thefirst significant engine control, which is calculated in the processing35, to the engine control device 20 via the network 10.

Next, at a time point t52, the data transmission/reception means 21executes the processing 18 to receive the control amount regarding thefirst significant engine control, which is transmitted via the network10 from the meter control device 30.

Next, at a time point t53, the instruction means for transmissionsuspension/suspension cancellation 22 executes the processing 19 totransmit, via the network 10, the suspension canceling instruction toall the other control devices connected to the network 10.

Next, at a time point t54, the data transmission/reception means 21, thedata transmission/reception means 31, and the datatransmission/reception means 41 simultaneously execute the processing 20and the processing 39, and the processing 44, respectively, to resumethe transmission of data irrelevant to the first significant enginecontrol according to the suspension canceling instruction transmittedfrom the instruction means for transmission suspension/suspensioncancellation 22.

Next, at a time point t55, the comparison means 26 executes theprocessing 21 to compare the control amount regarding the firstsignificant engine control, which is calculated in the processing 16,and the control amount regarding the first significant engine control,which is received in the processing 18. Here, because there is noabnormality in both of the control amount calculation means 25 and thecontrol amount calculation means 35, the control amounts regarding thefirst significant engine control have the same value. Accordingly, thecomparison means 26 outputs the control amount regarding the firstsignificant engine control to the engine control means 27.

Next, at a time point t56, the engine control means 27 executes theprocessing 22 to execute the control of the engine unit 200 based on thecontrol amount regarding the first significant engine control, which hasbeen input from the comparison means 26.

Next, description is given of the processing of the second significantcontrol stage.

First, at a time point t57, the data collection means 24 executes theprocessing 51 to cause the storage means 23 to store the data necessaryfor calculating the control amount regarding the second significantengine control in the storage area for data necessary for calculation243.

Next, at a time point t58, the instruction means for transmissionsuspension/suspension cancellation 22 executes the processing 52 totransmit, via the network 10, the transmission suspending instruction toall the other control devices connected to the network 10.

Next, at a time point t59, the data transmission/reception means 21, thedata transmission/reception means 31, and the datatransmission/reception means 41 simultaneously execute the processing53, the processing 71, and the processing 81, respectively, to suspendthe transmission of data irrelevant to the second significant enginecontrol according to the transmission suspending instruction transmittedfrom the instruction means for transmission suspension/suspensioncancellation 22.

Next, at a time point t60, the data transmission/reception means 21executes the processing 54 to transmit, via the network 10, the datanecessary for calculating the control amount regarding the secondsignificant engine control to the AT control device 40.

Next, at a time point t61, the data transmission/reception means 41 andthe data saving means 44 execute the processing 82 to cause the storagemeans 43 to store, in the storage area for data necessary forcalculation 443, the received data necessary for calculating the controlamount regarding the second significant engine control.

Next, at a time point t62, the instruction means for transmissionsuspension/suspension cancellation 42 executes the processing 83 totransmit, via the network 10, the suspension canceling instruction toall the other control devices connected to the network 10.

Next, at a time point t63, the data transmission/reception means 21, thedata transmission/reception means 31, and the datatransmission/reception means 41 simultaneously execute the processing55, the processing 72, and the processing 84, respectively, to resumethe transmission of data irrelevant to the second significant enginecontrol according to the suspension canceling instruction transmittedfrom the instruction means for transmission suspension/suspensioncancellation 42.

Next, at a time point t64, by using the above-mentioned method ofsynchronizing the timings with each other, the control amountcalculation means 25 and the control amount calculation means 45simultaneously execute the processing 56 and the processing 85,respectively. The control amount calculation means 25 and the controlamount calculation means 45 calculate control amounts regarding thesecond significant engine control based on the control amountcalculating procedure for second significant engine control 235 and therespective pieces of data necessary for calculating the control amountregarding the second significant engine control, which are stored in thestorage means 23 and the storage means 43.

Next, at a time point t65, the instruction means for transmissionsuspension/suspension cancellation 42 executes the processing 86 totransmit, via the network 10, the transmission suspending instruction toall the other control devices connected to the network 10.

Next, at a time point t66, the data transmission/reception means 21, thedata transmission/reception means 31, and the datatransmission/reception means 41 simultaneously execute the processing57, the processing 73, and the processing 87, respectively, to suspendthe transmission of data irrelevant to the second significant enginecontrol according to the transmission suspending instruction transmittedfrom the instruction means for transmission suspension/suspensioncancellation 42.

Next, at a time point t67, the data transmission/reception means 41executes the processing 88 to transmit the control amount regarding thesecond significant engine control, which is calculated in the processing85, to the engine control device 20 via the network 10.

Next, at a time point t68, the data transmission/reception means 21executes the processing 58 to receive the control amount regarding thesecond significant engine control, which is transmitted via the network10 from the AT control device 40.

Next, at a time point t69, the instruction means for transmissionsuspension/suspension cancellation 22 executes the processing 59 totransmit, via the network 10, the suspension canceling instruction toall the other control devices connected to the network 10.

Next, at a time point t70, the data transmission/reception means 21, thedata transmission/reception means 31, and the datatransmission/reception means 41 simultaneously execute the processing60, and the processing 74, and the processing 89, respectively, toresume the transmission of data irrelevant to the second significantengine control according to the suspension canceling instructiontransmitted from the instruction means for transmissionsuspension/suspension cancellation 22.

Next, at a time point t71, the comparison means 26 executes theprocessing 61 to compare the control amount regarding the secondsignificant engine control, which is calculated in the processing 56,and the control amount regarding the second significant engine control,which is received in the processing 58. Here, because there is noabnormality in both of the control amount calculation means 25 and thecontrol amount calculation means 45, the control amounts regarding thesecond significant engine control have the same value. Accordingly, thecomparison means 26 outputs the control amount regarding the secondsignificant engine control to the engine control means 27.

Next, at a time point t72, the engine control means 27 executes theprocessing 62 to execute the control of the engine unit 200 based on thecontrol amount regarding the second significant engine control, whichhas been input from the comparison means 26.

Next, with reference to the timing chart of FIG. 9, description is givenof operation of the control system, which is performed in a case wherethere is an abnormality in any one of the control amount calculationmeans 25, the control amount calculation means 35, and the controlamount calculation means 45. Here, the description is given by taking asan example a case where, due to an abnormality in the control amountcalculation means 25, only the control amount regarding the secondsignificant engine control cannot be calculated accurately while thecontrol amount regarding the first significant engine control can becalculated accurately.

It should be noted that because the processing of the first significantcontrol stage and the processing from the time point t57 to the timepoint t63 of the second significant control stage are the same as theabove-mentioned processing performed in a case where there is noabnormality in the control amount calculation means 25, the controlamount calculation means 35, and the control amount calculation means45, description thereof is omitted.

First, at the time point t64, the control amount calculation means 25and the control amount calculation means 45 simultaneously execute theprocessing 56 and the processing 85, respectively. The control amountcalculation means 25 calculates the control amount regarding the secondsignificant engine control based on the data necessary for calculatingthe control amount regarding the second significant engine control andthe control amount calculating procedure for second significant enginecontrol 235, which are stored in the storage means 23. Here, because,due to an abnormality in the control amount calculation means 25, onlythe control amount regarding the second significant engine controlcannot be calculated accurately, the calculated control amount regardingthe second significant engine control has a different value from thecontrol amount that is to be obtained originally.

On the other hand, the control amount calculation means 45 calculatesthe control amount regarding the second significant engine control basedon the data necessary for calculating the control amount regarding thesecond significant engine control and the control amount calculatingprocedure for second significant engine control 235, which are stored inthe storage means 43.

Further, the processing from the time point t65 to the time point t70 ofthe second significant control stage is also the same as theabove-mentioned processing performed in a case where there is noabnormality in the control amount calculation means 25, the controlamount calculation means 35, and the control amount calculation means45, and hence description thereof is omitted.

Next, at the time point t71, the comparison means 26 executes theprocessing 61 to compare the control amount regarding the secondsignificant engine control, which is calculated in the processing 56,and the control amount regarding the second significant engine control,which is received in the processing 58. Here, because there is anabnormality in the control amount calculation means 25, the controlamounts regarding the second significant engine control have differentvalues. Accordingly, the comparison means 26 outputs to the enginecontrol means 27 the notification indicating that the control amountsare different.

Next, at the time point t72, the engine control means 27 executes theprocessing 62. However, due to input of the notification indicating thatthe control amounts are different from the comparison means 26, theengine control means 27 does not execute the control of the engine unit200.

In this manner, by comparing the control amount regarding the firstsignificant engine control, which is calculated by the control amountcalculation means 25, and the control amount regarding the firstsignificant engine control, which is calculated by the control amountcalculation means 35, and comparing and examining the control amountregarding the second significant engine control, which is calculated bythe control amount calculation means 25, and the control amountregarding the second significant engine control, which is calculated bythe control amount calculation means 45, it is possible to detectwhether or not there is an abnormality in any one of the control amountcalculation means 25, the control amount calculation means 35, and thecontrol amount calculation means 45.

Specifically, by comparing the control amount regarding the firstsignificant engine control, which is calculated by the control amountcalculation means 25, and the control amount regarding the firstsignificant engine control, which is calculated by the control amountcalculation means 35, and comparing the control amount regarding thesecond significant engine control, which is calculated by the controlamount calculation means 25, and the control amount regarding the secondsignificant engine control, which is calculated by the control amountcalculation means 45, and, when the respective pairs of the controlamounts have the same values, executing the control of the engine unit200 based on the respective control amounts, and, when at least one pairof the control amounts has different values, avoiding executing thecontrol of the engine unit 200 for both the significant controls, it ispossible to reduce the cost of the control system while securing thereliability of the control without providing two microcomputers or amonitoring circuit within the engine control device 20 and without beingaffected by the network communication status at the time oftransmission.

Further, while the control amount regarding the first significant enginecontrol or the control amount regarding the second significant enginecontrol is being calculated in the engine control device 20 (originalcalculation), the corresponding control amounts are simultaneouslycalculated by the control amount calculation means 35 of the metercontrol device 30 and the control amount calculation means 45 of the ATcontrol device 40, to thereby compare results of the calculations. Then,when at least one pair of the control amounts has the same value, thecontrol of the engine unit 200 is executed only for the firstsignificant engine control or the second significant engine control, forwhich the control amounts have the same value. As a result, at the timeof carrying out not the calculation for the abnormality detection butthe original calculation, it is possible to judge whether or not thereis an abnormality, thereby securing the reliability of the control.

In addition, while the control amount regarding the first significantengine control is being calculated in the engine control device 20, thecorresponding control amount is simultaneously calculated by the controlamount calculation means 35 of the meter control device 30.Consequently, comparison between the calculation results can be made assoon as possible, and hence it is also possible to reduce a processingtime required for the first significant engine control.

Further, while the control amount regarding the second significantengine control is being calculated in the engine control device 20, thecorresponding control amount is simultaneously calculated by the controlamount calculation means 45 of the AT control device 40. Consequently,comparison between the calculation results can be made as soon aspossible, and hence it also becomes possible to reduce a processing timerequired for the second significant engine control.

As described above, according to the second embodiment, there areprovided a first control device, a second control device, and a thirdcontrol device, which are connected to a network in which availabilityof transmission is determined based on a communication status at thetime of the transmission. The first control device includes: a firstcontrol amount calculation means for calculating a control amountregarding a first significant control and a control amount regarding asecond significant control based on a first control amount calculatingprocedure for calculating the control amount regarding the firstsignificant control, a second control amount calculating procedure forcalculating the control amount regarding the second significant control,data for first control necessary for calculating the control amountregarding the first significant control for the control target of thefirst control device, and data for second control necessary forcalculating the control amount regarding the second significant controlfor the control target of the first control device; comparison means forcomparing the control amount regarding the first significant control,which is calculated by the first control amount calculation means, andthe control amount regarding the first significant control, which iscalculated by the second control device, and comparing the controlamount regarding the second significant control, which is calculated bythe first control amount calculation means, and the control amountregarding the second significant control, which is calculated by thethird control device; control means for controlling the control targetbased on results of the comparison made by the comparison means; and afirst instruction means for transmission suspension/suspensioncancellation for transmitting, to all the other control devicesconnected to the network, one of a transmission suspending instructionand a suspension canceling instruction. Further, the second controldevice includes: a second storage means for storing the first controlamount calculating procedure and the data for first control, which isreceived from the first control device via the network; a second controlamount calculation means for calculating the control amount regardingthe first significant control based on the first control amountcalculating procedure and the data for first control; and a secondinstruction means for transmission suspension/suspension cancellationfor transmitting, to all the other control devices connected to thenetwork, one of the transmission suspending instruction and thesuspension canceling instruction. Further, the third control deviceincludes: a third storage means for storing the second control amountcalculating procedure and the data for second control, which is receivedfrom the first control device via the network; a third control amountcalculation means for calculating the control amount regarding thesecond significant control based on the second control amountcalculating procedure and the data for second control; and a thirdinstruction means for transmission suspension/suspension cancellationfor transmitting, to all the other control devices connected to thenetwork, one of the transmission suspending instruction and thesuspension canceling instruction.

Therefore, without providing two microcomputers having the samefunctions or a monitoring circuit within the control device and withoutbeing affected by the network communication status at the time oftransmission, by comparing the control amount regarding the firstsignificant control, which is calculated by the first control amountcalculation means, and the control amount regarding the firstsignificant control, which is calculated by the second control device,and comparing and examining the control amount regarding the secondsignificant control, which is calculated by the first control amountcalculation means, and the control amount regarding the secondsignificant control, which is calculated by the third control device, itis possible to obtain a control system capable of reducing the costwhile securing the reliability of the control.

Further, when the comparison means judges that the compared controlamounts regarding the first significant control and the compared controlamounts regarding the second significant control have the same values,respectively, the control means controls the control target based on thecontrol amounts regarding the first significant control having the samevalue and the control amounts regarding the second significant controlhaving the same value. When the comparison means judges that at leastone of a pair of the compared control amounts regarding the firstsignificant control and a pair of the compared control amounts regardingthe second significant control has different values, the control meansdoes not control the control target. Further, when the comparison meansjudges that at least one of a pair of the compared control amountsregarding the first significant control and a pair of the comparedcontrol amounts regarding the second significant control has differentvalues, the control device controls the control target only for thefirst significant control or the second significant control, for whichthe control amounts have the same value. Therefore, the reliability ofthe control can be improved.

Here, in the second embodiment described above, there has been given thedescription in which, when the notification indicating that the controlamounts are different has been input from the comparison means 26, theengine control means 27 does not execute the control of the engine unit200. However, the present invention is not limited thereto. When thenotification indicating that the control amounts are different has beeninput from the comparison means 26, the engine control means 27 mayexecute the control of the engine unit 200 with regard to thesignificant control for which the control amounts are different or withregard to both the significant controls, based on predetermined controlamounts previously set as a control amount regarding the firstsignificant engine control and a control amount regarding the secondsignificant engine control, respectively. Further, instead of thepredetermined control amounts, the engine control means 27 may use thecontrol amount calculated last time.

In this case, even if an abnormality has occurred in any one of thecontrol amount calculation means 25, the control amount calculationmeans 35, and the control amount calculation means 45, it is possible tocontinue the control without stopping the engine.

Further, in the second embodiment described above, there has been giventhe description in which the timings at which the processing 16 of theengine control device 20 and the processing 35 of the meter controldevice 30 are started are synchronized with each other. However, even ifa time lag has occurred in the processing start due to the timings thatare not synchronized with each other, this does not inflict asignificant adverse effect on an object of the present invention, whichis to improve the reliability of the control.

Further, in the second embodiment described above, there has been giventhe description in which the timings at which the processing 56 of theengine control device 20 and the processing 85 of the AT control device40 are started are synchronized with each other. However, even if a timelag has occurred in the processing start due to the timings that are notsynchronized with each other, this does not inflict a significantadverse effect on the object of the present invention, which is toimprove the reliability of the control.

Further, in the second embodiment described above, the control amountcalculation means 25, the control amount calculation means 35, and thecontrol amount calculation means 45 may have an identical configurationby, for example, using microcomputers of the same model number from thesame manufacturer.

In this case, the control amounts can be calculated more accurately. Inaddition, by executing the control of the engine unit 200 based onresults obtained through comparison among such control amounts, it ispossible to improve the reliability of the control.

Further, in the second embodiment described above, the storage means 23,the storage means 33, and the storage means 43 may have an identicalconfiguration by, for example, using memories of the same model numberfrom the same manufacturer. Then, the control amount calculatingprocedure for first significant engine control 232 may be stored at thesame location of each of the storage means 23 and the storage means 33.The control amount calculating procedure for second significant enginecontrol 235 may be stored at the same location of each of the storagemeans 23 and the storage means 43.

In this case, the control amounts can be calculated more accurately. Inaddition, by executing the control of the engine unit 200 based onresults obtained through comparison among such control amounts, it ispossible to improve the reliability of the control.

Further, in the second embodiment described above, the storage means 23,the storage means 33, and the storage means 43 may have an identicalconfiguration by, for example, using memories of the same model numberfrom the same manufacturer. Then, the storage area for data necessaryfor calculation 243 and the storage area for data necessary forcalculation 343, in which data necessary for calculating a controlamount regarding the first significant engine control is stored, may belocated at the same location of each of the storage means 23 and thestorage means 33. The storage area for data necessary for calculation243 and the storage area for data necessary for calculation 443, inwhich data necessary for calculating a control amount regarding thesecond significant engine control is stored, may be located at the samelocation of each of the storage means 23 and the storage means 43.

In this case, the control amounts can be calculated more accurately. Inaddition, by executing the control of the engine unit 200 based onresults obtained through comparison among such control amounts, it ispossible to improve the reliability of the control.

Further, in the second embodiment described above, there has been giventhe description of the case where an abnormality occurs in the controlamount calculation means 25. According to the second embodiment, even ifunintended data change, data corruption, or the like has occurred afterthe data necessary for calculating a control amount regarding the firstsignificant engine control is transmitted to the meter control device 30by the data transmission/reception means 21 or after the data necessaryfor calculating a control amount regarding the second significant enginecontrol is transmitted to the AT control device 40 by the datatransmission/reception means 21, it is possible to improve thereliability of the control by executing the control of the engine unit200 based on results obtained through comparison among the calculatedcontrol amounts.

Further, in the second embodiment described above, there has been giventhe description by taking as an example the case where three controldevices are used, but the present invention is not limited thereto. Evenif four or more control devices are used, the same effect can beobtained.

Further, in the second embodiment described above, the followingdescription has been given. That is, when the transmission suspendinginstruction has been transmitted from the instruction means fortransmission suspension/suspension cancellation 22, the instructionmeans for transmission suspension/suspension cancellation 32 or theinstruction means for transmission suspension/suspension cancellation 42transmits the suspension canceling instruction. When the transmissionsuspending instruction has been transmitted from the instruction meansfor transmission suspension/suspension cancellation 32 or theinstruction means for transmission suspension/suspension cancellation42, the instruction means for transmission suspension/suspensioncancellation 22 transmits the suspension canceling instruction. However,the present invention is not limited thereto. For example, when apredetermined period of time has elapsed after transmission of thetransmission suspending instruction from the instruction means fortransmission suspension/suspension cancellation 22, the instructionmeans for transmission suspension/suspension cancellation 22 maytransmit the suspension canceling instruction. Alternatively, when apredetermined period of time has elapsed after transmission of thetransmission suspending instruction from the instruction means fortransmission suspension/suspension cancellation 32 or the instructionmeans for transmission suspension/suspension cancellation 42, theinstruction means for transmission suspension/suspension cancellation 32or the instruction means for transmission suspension/suspensioncancellation 42 may transmit the suspension canceling instruction. Insuch cases, the predetermined period of time has a time length longenough to judge that the data regarding the first significant enginecontrol or the data regarding the second significant engine control hasbeen received on the reception side without fail.

In this manner, the suspension canceling instruction is transmitted bythe instruction means for transmission suspension/suspensioncancellation of the control device that has transmitted the dataregarding the first significant engine control or the data regarding thesecond significant engine control, and hence the same effect as in thesecond embodiment described above can be obtained. Further, even if theinstruction means for transmission suspension/suspension cancellation onthe reception side is in a state of not being able to cancel thesuspension of data transmission due to a failure or the like, theinstruction means for transmission suspension/suspension cancellation onthe transmission side can cancel the suspension of transmission bytransmitting the suspension canceling instruction after thepredetermined period of time. Consequently, it is possible to reduce anadverse effect on the entire network, which is caused by continuation ofthe transmission suspension.

Further, in the first and second embodiments described above, thestorage means and the control amount calculation means are described asbeing separate components, but the present invention is not limitedthereto. Even if a storage area is provided inside the control amountcalculation means, the same effect can be obtained.

Further, in the first and second embodiments described above, nodetailed description has been given of the timing at which each of theinstruction means for transmission suspension/suspension cancellation22, the instruction means for transmission suspension/suspensioncancellation 32, and the instruction means for transmissionsuspension/suspension cancellation 42 transmits the transmissionsuspending instruction. However, by putting a higher priority ontransmission data containing the transmission suspending instructionthan other pieces of transmission data, and by transmitting thetransmission suspending instruction with a sufficient time lag inconsideration of a case where the data has already been transmitted tothe network 10, it is possible to suspend the data transmission from theother control devices without fail before the data regarding thesignificant engine control starts to be transmitted.

Third Embodiment

FIG. 10 is a block configuration diagram illustrating a control systemaccording to a third embodiment of the present invention.

In FIG. 10, the control system includes a vehicle-mounted network 10(hereinbelow, referred to as “network 10”), an engine control device 20(first control device) connected to the network 10, and a meter controldevice 30 (second control device). Further, the engine control device 20and the meter control device 30 are connected to an engine unit 200 anda meter unit 300, respectively, which are control targets.

Here, as the network 10, there is employed a FlexRay network forperforming communication compliant with the FlexRay® communicationprotocol V2.1 Rev.A (hereinbelow, referred to as “FlexRaycommunication”). With this FlexRay network, time synchronization ispossible between nodes connected thereto. Incidentally, FlexRaycommunication is a well-known technology, and hence detailed descriptionthereof is omitted.

It should be noted that the network is not limited to the networkdescribed above, and another network may be used as long as the networkis capable of time synchronization between nodes connected thereto.

Next, description is given of a configuration and functions of theengine control device 20.

The engine control device 20 includes data transmission/reception means21, time synchronization means 28 (first time synchronization means),storage means 23 (first storage means), data collection means 24,control amount calculation means 25 (first control amount calculationmeans), comparison means 26, and engine control means 27 (controlmeans). Further, the control amount calculation means 25 is configuredby a microcomputer.

Further, apart from the above-mentioned means, the engine control device20 includes other necessary components. However, those components do nothave direct relevance to the third embodiment, and hence descriptionthereof is omitted.

The data transmission/reception means 21 transmits and receives data toand from, via the network 10, other control devices (including the metercontrol device 30) connected to the network 10. The time synchronizationmeans 28 executes time synchronization between control devices connectedto the network 10. The storage means 23 stores various pieces of data,which are described below.

The data collection means 24 collects data necessary for engine control(data for first control). The control amount calculation means 25calculates a control amount necessary for the engine control accordingto a processing procedure described below. The comparison means 26compares the control amount calculated by the control amount calculationmeans 25 with a control amount received from the other control devices(including the meter control device 30) connected to the network 10. Theengine control means 27 executes control of the engine unit 200 based onthe calculated control amount.

Next, referring to FIG. 2, detailed description is given of the storagemeans 23 of the engine control device 20.

In FIG. 2, the storage means 23 is divided into a ROM area 230 in whichno other data can be stored apart from previously-stored data and a RAMarea 240 in which data can be stored.

The ROM area 230 contains other ROM data 231, a control amountcalculating procedure for first significant engine control (firstsignificant control) 232 (first control amount calculating procedure), acontrol amount calculating procedure for normal engine control 233, anda free area 234.

Here, the other ROM data 231 and the free area 234 have no directrelevance to the third embodiment, and hence description thereof isomitted.

The control amount calculating procedure for first significant enginecontrol 232 indicates a procedure for calculating a control amountregarding the first significant engine control, whereas the controlamount calculating procedure for normal engine control 233 indicates aprocedure for calculating a control amount regarding the normal enginecontrol.

Here, the first significant engine control refers to such control thatmay endanger the vehicle, the driver, the surroundings of the vehicle,etc. depending on a calculation result, and therefore refers to suchcontrol that requires high reliability.

Further, the RAM area 240 contains other RAM data 241, a free area 242,a storage area for data necessary for calculation 243, and a free area244.

Here, the other RAM data 241, the free area 242, and the free area 244have no direct relevance to the third embodiment, and hence descriptionthereof is omitted.

The storage area for data necessary for calculation 243 is an area inwhich data necessary for calculating a control amount regarding thefirst significant engine control is stored.

Next, referring back to FIG. 10, description is given of a configurationand functions of the meter control device 30.

The meter control device 30 includes data transmission/reception means31, time synchronization means 38 (second time synchronization means),storage means 33 (second storage means), data saving means 34, controlamount calculation means 35 (second control amount calculation means),and meter control means 36. Further, the control amount calculationmeans 35 is configured by a microcomputer.

Further, apart from the above-mentioned means, the meter control device30 includes other necessary components. However, those components do nothave direct relevance to the third embodiment, and hence descriptionthereof is omitted.

The data transmission/reception means 31 transmits and receives data toand from, via the network 10, other control devices (including theengine control device 20) connected to the network 10. The timesynchronization means 38 executes time synchronization between controldevices connected to the network 10. The storage means 33 stores variouspieces of data, which are described below.

The data saving means 34 causes the storage means 33 to store the datanecessary for calculating the control amount regarding the firstsignificant engine control, which is received from the engine controldevice 20. The control amount calculation means 35 calculates a controlamount necessary for the meter control and the engine control accordingto a processing procedure described below. The meter control means 36executes control of the meter unit 300 based on the calculated controlamount.

Next, referring to FIG. 3, detailed description is given of the storagemeans 33 of the meter control device 30.

In FIG. 3, the storage means 33 is divided into a ROM area 330 in whichno other data can be stored apart from previously-stored data and a RAMarea 340 in which data can be stored.

The ROM area 330 contains other ROM data 331, a control amountcalculating procedure for first significant engine control 232, acontrol amount calculating procedure for meter control 333, and a freearea 334.

Here, the other ROM data 331 and the free area 334 have no directrelevance to the third embodiment, and hence description thereof isomitted.

The control amount calculating procedure for first significant enginecontrol 232 indicates a procedure for calculating a control amountregarding the first significant engine control. The storage means 23 andthe storage means 33 each store the same control amount calculatingprocedure for first significant engine control. The control amountcalculating procedure for meter control 333 indicates a procedure forcalculating a control amount regarding the meter control.

Further, the RAM area 340 contains other RAM data 341, a free area 342,a storage area for data necessary for calculation 343, other RAM data344, and a free area 345.

Here, the other RAM data 341, the free area 342, the other RAM data 344,and the free area 345 have no direct relevance to the third embodiment,and hence description thereof is omitted.

The storage area for data necessary for calculation 343 is an area inwhich data necessary for calculating a control amount regarding thefirst significant engine control is stored.

It should be noted that, in FIG. 10, the data transmission/receptionmeans 21 and the data transmission/reception means 31 may be identicalto each other. Similarly, in FIG. 10, the time synchronization means 28and the time synchronization means 38 may be identical to each other.

Hereinbelow, referring to a timing chart of FIG. 11, description isgiven of operation of the control system according to the thirdembodiment of the present invention. Here, description is given ofprocessing related to the first significant engine control.

In FIG. 11, the horizontal axes represent engine control device time,which indicates the flow of time in the engine control device 20, metercontrol device time, which indicates the flow of time in the metercontrol device 30, and network time, which indicates the flow of time inthe network 10.

Further, in FIG. 11, the engine control device 20 executes processing offrom processing 111 to processing 117. Further, the meter control device30 executes processing of from processing 121 to processing 124.

Here, the processing 111 and the processing 121 are processing of asynchronization stage. The processing of from the processing 112 to theprocessing 117 and from the processing 122 to the processing 124 isprocessing of a first significant control stage.

It should be noted that the processing of the synchronization stage isnot executed routinely, but is executed when the engine control devicetime and the meter control device time need to be synchronized with thenetwork time, such as after the boot-up or the initialization of eachcontrol device. Further, the processing of the first significant controlstage is repeatedly executed every time the processing related to thefirst significant engine control is performed.

Next, description is given of the processing of from the processing 111to the processing 117 performed by the engine control device 20.

In the processing 111, as initialization processing performed at thetime of the boot-up of the engine control device 20, for example, thetime synchronization means 28 joins the network 10 to synchronize theengine control device time with the network time.

In the processing 112, the data collection means 24 collects datanecessary for calculating the control amount regarding the firstsignificant engine control, and then causes the storage means 23 tostore the collected data in the storage area for data necessary forcalculation 243.

In the processing 113, the data transmission/reception means 21transmits, to the meter control device 30, the data necessary forcalculating the control amount regarding the first significant enginecontrol.

In the processing 114, the control amount calculation means 25calculates the control amount regarding the first significant enginecontrol based on the data necessary for calculating the control amountregarding the first significant engine control and the control amountcalculating procedure for first significant engine control 232, whichare stored in the storage means 23.

In the processing 115, the data transmission/reception means 21 receivesa control amount regarding the first significant engine control, whichis transmitted from the meter control device 30.

In the processing 116, the comparison means 26 compares the controlamount regarding the first significant engine control, which iscalculated in the processing 114, and the control amount regarding thefirst significant engine control, which is received in the processing115. Then, when the two control amounts have the same value, thecomparison means 26 outputs the control amount regarding the firstsignificant engine control to the engine control means 27. When the twocontrol amounts have different values, the comparison means 26 outputsto the engine control means 27 a notification indicating that thecontrol amounts are different.

In the processing 117, the engine control means 27 executes control ofthe engine unit 200 based on a result of the comparison made by thecomparison means 26. Specifically, when the control amount regarding thefirst significant engine control has been input from the comparisonmeans 26, the engine control means 27 executes the control of the engineunit 200 based on this control amount. When the notification indicatingthat the control amounts are different has been input from thecomparison means 26, the engine control means 27 does not execute thecontrol of the engine unit 200.

Next, description is given of the processing of from the processing 121to the processing 124 performed by the meter control device 30.

In the processing 121, as initialization processing performed at thetime of the boot-up of the meter control device 30, for example, thetime synchronization means 38 joins the network 10 to synchronize themeter control device time with the network time.

In the processing 122, the data transmission/reception means 31 receivesthe data necessary for calculating the control amount regarding thefirst significant engine control, which is transmitted from the enginecontrol device 20. Then, the data saving means 34 causes the storagemeans 33 to store the received data in the storage area for datanecessary for calculation 343.

In the processing 123, the control amount calculation means 35calculates the control amount regarding the first significant enginecontrol based on the data necessary for calculating the control amountregarding the first significant engine control, and the control amountcalculating procedure for first significant engine control 232, whichare stored in the storage means 33.

In the processing 124, the data transmission/reception means 31transmits, to the engine control device 20, the control amount regardingthe first significant engine control, which is calculated in theprocessing 123.

It should be noted that, in the engine control device 20, after theprocessing 111, the engine control device time and the network time areidentical due to the synchronization. Further, in the meter controldevice 30, after the processing 121, the meter control device time andthe network time are identical due to the synchronization.

In the timing chart illustrated in FIG. 11, only the processing relatedto the first significant engine control is illustrated for the purposeof clarifying the features of the third embodiment. However, inactuality, not only this processing, there exist processing related tothe normal engine control and processing related to the meter control inthe engine control device 20 and in the meter control device 30,respectively. These processings are executed in the respective controldevices during the free time in which the processing related to thefirst significant engine control (processing of first significantcontrol stage of FIG. 11) is not executed.

Next, referring to the timing chart of FIG. 11, description is given ofoperation of the control system, which is performed in a case wherethere is no abnormality in both of the control amount calculation means25 and the control amount calculation means 35, enabling the controlamounts regarding the first significant engine control to be calculatedaccurately.

First, description is given of the processing of the synchronizationstage.

First, the engine control device 20 is booted by a time point t101, and,at the time point t101, the time synchronization means 28 executes theprocessing 111. In the engine control device 20, after a time pointt102, at which the processing 111 ends, the engine control device timeand the network time are identical due to the synchronization.

Next, the meter control device 30 is booted by a time point t103, and,at the time point t103, the time synchronization means 38 executes theprocessing 121. In the meter control device 30, after a time point t104,at which the processing 121 ends, the meter control device time and thenetwork time are identical due to the synchronization.

Next, description is given of the processing of the first significantcontrol stage.

First, at a time point t105, the data collection means 24 executes theprocessing 112 to cause the storage means 23 to store the data necessaryfor calculating the control amount regarding the first significantengine control in the storage area for data necessary for calculation243.

Next, at a time point t106, the data transmission/reception means 21executes the processing 113 to transmit, via the network 10, the datanecessary for calculating the control amount regarding the firstsignificant engine control to the meter control device 30.

Next, at a time point t107, the data transmission/reception means 31 andthe data saving means 34 execute the processing 122 to cause the storagemeans 33 to store, in the storage area for data necessary forcalculation 343, the received data necessary for calculating the controlamount regarding the first significant engine control.

Next, at a time point t108, the control amount calculation means 25 andthe control amount calculation means 35 simultaneously execute theprocessing 114 and the processing 123, respectively. The control amountcalculation means 25 and the control amount calculation means 35calculate control amounts regarding the first significant engine controlbased on the control amount calculating procedure for first significantengine control 232 and the respective pieces of data necessary forcalculating the control amount regarding the first significant enginecontrol, which are stored in the storage means 23 and the storage means33.

Next, at a time point t109, the data transmission/reception means 31executes the processing 124 to transmit the control amount regarding thefirst significant engine control, which is calculated in the processing123, to the engine control device 20 via the network 10.

Next, at a time point t110, the data transmission/reception means 21executes the processing 115 to receive the control amount regarding thefirst significant engine control, which is transmitted via the network10 from the meter control device 30.

Next, at a time point t111, the comparison means 26 executes theprocessing 116 to compare the control amount regarding the firstsignificant engine control, which is calculated in the processing 114,and the control amount regarding the first significant engine control,which is received in the processing 115. Here, because there is noabnormality in both of the control amount calculation means 25 and thecontrol amount calculation means 35, the control amounts regarding thefirst significant engine control have the same value. Accordingly, thecomparison means 26 outputs the control amount regarding the firstsignificant engine control to the engine control means 27.

Next, at a time point t112, the engine control means 27 executes theprocessing 117 to execute the control of the engine unit 200 based onthe control amount regarding the first significant engine control, whichhas been input from the comparison means 26.

Next, referring to the timing chart of FIG. 11, description is given ofoperation of the control system, which is performed in a case wherethere is an abnormality in any one of the control amount calculationmeans 25 and the control amount calculation means 35.

It should be noted that because the processing of the synchronizationstage and the processing from the time point t105 to the time point t107of the first significant control stage are the same as theabove-mentioned processing performed in a case where there is noabnormality in the control amount calculation means 25 and the controlamount calculation means 35, description thereof is omitted.

First, at the time point t108, the control amount calculation means 25and the control amount calculation means 35 simultaneously execute theprocessing 114 and the processing 123, respectively. The control amountcalculation means 25 calculates the control amount regarding the firstsignificant engine control based on the data necessary for calculatingthe control amount regarding the first significant engine control andthe control amount calculating procedure for first significant enginecontrol 232, which are stored in the storage means 23. Here, forexample, if there is an abnormality in the control amount calculationmeans 25, the calculated control amount regarding the first significantengine control has a different value from the control amount that is tobe obtained originally.

On the other hand, the control amount calculation means 35 calculatesthe control amount regarding the first significant engine control basedon the data necessary for calculating the control amount regarding thefirst significant engine control and the control amount calculatingprocedure for first significant engine control 232, which are stored inthe storage means 33.

It should be noted that the processing of the time point t109 and thetime point t110 of the first significant control stage are also the sameas the above-mentioned processing performed in a case where there is noabnormality in the control amount calculation means 25 and the controlamount calculation means 35, and hence description thereof is omitted.

Next, at the time point t111, the comparison means 26 executes theprocessing 116 to compare the control amount regarding the firstsignificant engine control, which is calculated in the processing 114,and the control amount regarding the first significant engine control,which is received in the processing 115. Here, because there is anabnormality in the control amount calculation means 25, the controlamounts regarding the first significant engine control have differentvalues. Accordingly, the comparison means 26 outputs to the enginecontrol means 27 the notification indicating that the control amountsare different.

Next, at the time point t112, the engine control means 27 executes theprocessing 117. However, due to input of the notification indicatingthat the control amounts are different from the comparison means 26, theengine control means 27 does not execute the control of the engine unit200.

In this manner, by comparing and examining is made between the controlamount regarding the first significant engine control, which iscalculated by the control amount calculation means 25, and the controlamount regarding the first significant engine control, which iscalculated by the control amount calculation means 35, it is possible todetect whether or not there is an abnormality in any one of the controlamount calculation means 25 and the control amount calculation means 35.

Specifically, by comparing the control amount regarding the firstsignificant engine control, which is calculated by the control amountcalculation means 25, and the control amount regarding the firstsignificant engine control, which is calculated by the control amountcalculation means 35, and, when the two control amounts have the samevalue, executing the control of the engine unit 200 based on thatcontrol amount regarding the first significant engine control, it ispossible to reduce the cost of the control system while securingreliability of the control without providing two microcomputers or amonitoring circuit within the engine control device 20.

Further, while the control amount regarding the first significant enginecontrol is being calculated in the engine control device 20 (originalcalculation), the corresponding control amount is calculated by thecontrol amount calculation means 35 of the meter control device 30simultaneously, to thereby compare results of the calculations. Then,when both of the control amounts have the same value, the control of theengine unit 200 is executed based on the control amounts regarding thefirst significant engine control. As a result, at the time of carryingout not the calculation for the abnormality detection but the originalcalculation, it is possible to judge whether or not there is anabnormality, thereby securing the reliability of the control.

As described above, according to the third embodiment, there areprovided a first control device and a second control device, which areconnected to a network in which time synchronization is possible betweennodes connected thereto. The first control device includes: firstcontrol amount calculation means for calculating a control amountregarding a first significant control based on a first control amountcalculating procedure for calculating the control amount regarding thefirst significant control, and data for first control necessary forcalculating the control amount regarding the first significant controlfor a control target of the first control device; comparison means forcomparing the control amount regarding the first significant control,which is calculated by the first control amount calculation means, andthe control amount regarding the first significant control, which iscalculated by the second control device; and control means forcontrolling the control target based on a result of the comparison madeby the comparison means. The second control device includes secondstorage means for storing the first control amount calculating procedureand the data for first control, which is received from the first controldevice via the network, and second control amount calculation means forcalculating the control amount regarding the first significant controlbased on the first control amount calculating procedure and the data forfirst control.

Therefore, without providing two microcomputers having the samefunctions or a monitoring circuit within the control device, bycomparing and examining the control amount regarding the firstsignificant control, which is calculated by the first control amountcalculation means, and the control amount regarding the firstsignificant control, which is calculated by the second control device,it is possible to obtain a control system capable of reducing the costwhile securing the reliability of the control.

Further, when the comparison means judges that all of the comparedcontrol amounts regarding the first significant control have the samevalues, the control means controls the control target based on thecontrol amounts regarding the first significant control having the samevalue. When the comparison means judges that not all of the comparedcontrol amounts regarding the first significant control have the samevalues, the control means does not control the control target.Therefore, the reliability of the control can be improved.

Here, in the third embodiment described above, there has been given thedescription in which, when the notification indicating that the controlamounts are different has been input from the comparison means 26, theengine control means 27 does not execute the control of the engine unit200. However, the present invention is not limited thereto. When thenotification indicating that the control amounts are different has beeninput from the comparison means 26, the engine control means 27 mayexecute the control of the engine unit 200 based on a predeterminedcontrol amount previously set as a control amount regarding the firstsignificant engine control. Further, instead of the predeterminedcontrol amount, the engine control means 27 may use the control amountcalculated last time.

In this case, even if an abnormality has occurred in any one of thecontrol amount calculation means 25 and the control amount calculationmeans 35, it is possible to continue the control without stopping theengine.

Further, in the third embodiment described above, the control amountcalculation means 25 and the control amount calculation means 35 mayhave an identical configuration by, for example, using microcomputers ofthe same model number from the same manufacturer.

In this case, the control amounts can be calculated more accurately. Inaddition, by executing the control of the engine unit 200 based on aresult obtained through comparison between such control amounts, it ispossible to improve the reliability of the control.

Further, in the third embodiment described above, the storage means 23and the storage means 33 may have an identical configuration by, forexample, using memories of the same model number from the samemanufacturer. Then, the control amount calculating procedure for firstsignificant engine control 232 may be stored at the same location ofeach of the memories.

In this case, the control amounts can be calculated more accurately. Inaddition, by executing the control of the engine unit 200 based on aresult obtained through comparison among such control amounts, it ispossible to improve the reliability of the control.

Further, in the third embodiment described above, the storage means 23and the storage means 33 may have an identical configuration by, forexample, using memories of the same model number from the samemanufacturer. Then, the storage area for data necessary for calculation243 and the storage area for data necessary for calculation 343, inwhich data necessary for calculating a control amount regarding thefirst significant engine control is stored, may be located at the samelocation of each of the memories.

In this case, the control amounts can be calculated more accurately. Inaddition, by executing the control of the engine unit 200 based on aresult obtained through comparison among such control amounts, it ispossible to improve the reliability of the control.

Further, in the third embodiment described above, there has been giventhe description of the case where an abnormality occurs in the controlamount calculation means 25. According to the third embodiment, even ifunintended data change, data corruption, or the like has occurred afterthe data necessary for calculating a control amount regarding the firstsignificant engine control is transmitted to the meter control device 30by the data transmission/reception means 21, it is possible to improvethe reliability of the control by executing the control of the engineunit 200 based on a result obtained through comparison among thecalculated control amounts.

Fourth Embodiment

In the third embodiment described above, two control devices, which arethe engine control device 20 and the meter control device 30, calculatecontrol amounts regarding the first significant engine control tocompare the calculated control amounts. However, the present inventionis not limited thereto. Three or more control devices may each calculatea control amount regarding a significant control to compare thecalculated control amounts.

Hereinbelow, description is given by taking as an example a case wherethree control devices each calculate a control amount regarding asignificant control to compare the calculated control amounts.

FIG. 12 is a block configuration diagram illustrating a control systemaccording to a fourth embodiment of the present invention.

In FIG. 12, in addition to the control system illustrated in FIG. 10,the control system according to the fourth embodiment includes anautomatic transmission (AT) control device 40 (third control device)connected to the network 10. Further, the AT control device 40 isconnected to an AT unit 400, which is a control target.

Next, description is given of a configuration and functions of the ATcontrol device 40.

The AT control device 40 includes data transmission/reception means 41,time synchronization means 47 (third time synchronization means),storage means 43 (third storage means), data saving means 44, controlamount calculation means 45 (third control amount calculation means),and AT control means 46. Further, the control amount calculation means45 is configured by a microcomputer.

Further, apart from the above-mentioned means, the AT control device 40includes other necessary components. However, those components do nothave direct relevance to the fourth embodiment, and hence descriptionthereof is omitted.

The data transmission/reception means 41 transmits and receives data toand from, via the network 10, other control devices (including theengine control device 20 and the meter control device 30) connected tothe network 10. The time synchronization means 47 executes timesynchronization between control devices connected to the network 10. Thestorage means 43 stores various pieces of data, which are describedbelow.

The data saving means 44 causes the storage means 43 to store datanecessary for calculating a control amount regarding a first significantengine control, which is received from the engine control device 20. Thecontrol amount calculation means 45 calculates control amounts necessaryfor the AT control and the engine control based on a processingprocedure described below. The AT control means 46 executes control ofthe AT unit 400 based on the calculated control amount.

Next, referring to FIG. 13, detailed description is given of the storagemeans 43 of the AT control device 40.

In FIG. 13, the storage means 43 is divided into a ROM area 430 in whichno other data can be stored apart from previously-stored data and a RAMarea 440 in which data can be stored.

The ROM area 430 contains other ROM data 431, a control amountcalculating procedure for first significant engine control 232, acontrol amount calculating procedure for AT control 433, and a free area434.

Here, the other ROM data 431 and the free area 434 have no directrelevance to the fourth embodiment, and hence description thereof isomitted.

The control amount calculating procedure for first significant enginecontrol 232 indicates a procedure for calculating a control amountregarding the first significant engine control, and the storage means23, the storage means 33, and the storage means 43 each store the samecontrol amount calculating procedure for first significant enginecontrol 232. The control amount calculating procedure for AT control 433indicates a procedure for calculating a control amount regarding the ATcontrol.

Further, the RAM area 440 contains other RAM data 441, a free area 442,a storage area for data necessary for calculation 443, other RAM data444, and a free area 445.

Here, the other RAM data 441, the free area 442, the other RAM data 444,and the free area 445 have no direct relevance to the fourth embodiment,and hence description thereof is omitted.

The storage area for data necessary for calculation 443 is an area inwhich data necessary for calculating a control amount regarding thefirst significant engine control is stored.

It should be noted that, in FIG. 12, the data transmission/receptionmeans 21, the data transmission/reception means 31, and the datatransmission/reception means 41 may be identical to one another.Similarly, in FIG. 12, the time synchronization means 28, the timesynchronization means 38 and the time synchronization means 47 may beidentical to each other.

Further, the rest of the configuration and the functions are the same asin the third embodiment, and hence description thereof is omitted.

Hereinbelow, referring to a timing chart of FIG. 14, description isgiven of operation of the control system according to the fourthembodiment of the present invention. Here, description is given ofprocessing related to the first significant engine control.

In FIG. 14, the horizontal axes represent engine control device time,which indicates the flow of time in the engine control device 20, metercontrol device time, which indicates the flow of time in the metercontrol device 30, AT control device time, which indicates the flow oftime in the AT control device 40, and network time, which indicates theflow of time in the network 10.

Further, in FIG. 14, the AT control device 40 executes processing offrom processing 131 to processing 134. Further, the engine controldevice 20 executes processing 141 instead of the processing 113illustrated in FIG. 11, and executes processing 142 and processing 143instead of the processing 116.

Here, the rest of the processing is the same as in the third embodiment,and hence description thereof is omitted.

Here, the processing 111, the processing 121, and the processing 131 arethe processing of the synchronization stage, whereas the processing offrom the processing 112 to the processing 117, from the processing 122to the processing 124, and from the processing 132 to the processing 134is the processing of the first significant control stage.

It should be noted that the processing of the synchronization stage isnot executed routinely, but is executed when the engine control devicetime, the meter control device time, and the AT control device time needto be synchronized with the network time, such as after the boot-up orthe initialization of each control device. Further, the processing ofthe first significant control stage is repeatedly executed every timethe processing related to the first significant engine control isperformed.

Next, description is given of the processing of from the processing 131to the processing 134 performed by the AT control device 40.

In the processing 131, as initialization processing performed at thetime of the boot-up of the AT control device 40, for example, the timesynchronization means 47 joins the network 10 to synchronize the ATcontrol device time with the network time.

In the processing 132, the data transmission/reception means 41 receivesthe data necessary for calculating the control amount regarding thefirst significant engine control, which is transmitted from the enginecontrol device 20. Then, the data saving means 44 causes the storagemeans 43 to store the received data in the storage area for datanecessary for calculation 443.

In the processing 133, the control amount calculation means 45calculates the control amount regarding the first significant enginecontrol based on the data necessary for calculating the control amountregarding the first significant engine control, and the control amountcalculating procedure for first significant engine control 232, whichare stored in the storage means 43.

In the processing 134, the data transmission/reception means 41transmits, to the engine control device 20, the control amount regardingthe first significant engine control, which is calculated in theprocessing 133.

Next, description is given of the processing of from the processing 141to the processing 143 performed by the engine control device 20.

In the processing 141, the data transmission/reception means 21transmits, to the meter control device 30 and the AT control device 40,the data necessary for calculating the control amount regarding thefirst significant engine control.

In the processing 142, the data transmission/reception means 21 receivesthe control amount regarding the first significant engine control, whichis transmitted from the AT control device 40.

In the processing 143, the comparison means 26 compares the controlamount regarding the first significant engine control, which iscalculated in the processing 114, and the control amounts regarding thefirst significant engine control, which are received in the processing115 and the processing 142, respectively. Specifically, when all thecontrol amounts have the same value, the comparison means 26 outputs thecontrol amount regarding the first significant engine control to theengine control means 27. When two of the control amounts have the samevalue, the comparison means 26 outputs to the engine control means 27the control amount regarding the first significant engine control, whichrepresents the two same control amounts. When all the control amountshave different values, the comparison means 26 outputs to the enginecontrol means 27 a notification indicating that the control amounts aredifferent.

It should be noted that, in the engine control device 20, after theprocessing 111, the engine control device time and the network time areidentical due to the synchronization. Further, in the meter controldevice 30, after the processing 121, the meter control device time andthe network time are identical due to the synchronization. Further, inthe AT control device 40, after the processing 131, the AT controldevice time and the network time are identical due to thesynchronization.

In the timing chart illustrated in FIG. 14, only the processing relatedto the first significant engine control is illustrated for the purposeof clarifying the features of the fourth embodiment. However, inactuality, not only this processing, there exist processing related tothe normal engine control, processing related to the meter control, andprocessing related to the AT control in the engine control device 20, inthe meter control device 30, and in the AT control device 40,respectively. These processings are executed in the respective controldevices during the free time in which the processing related to thefirst significant engine control (processing of the first significantcontrol stage of FIG. 14) is not executed.

Next, referring to the timing chart of FIG. 14, description is given ofoperation of the control system, which is performed in a case wherethere is no abnormality in the control amount calculation means 25, thecontrol amount calculation means 35, and the control amount calculationmeans 45, enabling the control amount regarding the first significantengine control to be calculated accurately.

First, description is given of the processing of the synchronizationstage.

First, the engine control device 20 is booted by a time point t121, and,at the time point t121, the time synchronization means 28 executes theprocessing 111. In the engine control device 20, after a time pointt122, at which the processing 111 ends, the engine control device timeand the network time are identical due to the synchronization.

Next, the meter control device 30 is booted by a time point t123, and,at the time point t123, the time synchronization means 38 executes theprocessing 121. In the meter control device 30, after a time point t124,at which the processing 121 ends, the meter control device time and thenetwork time are identical due to the synchronization.

Next, the AT control device 40 is booted by a time point t125, and, atthe time point t125, the time synchronization means 47 executes theprocessing 131. In the AT control device 40, after a time point t126, atwhich the processing 131 ends, the AT control device time and thenetwork time are identical due to the synchronization.

Next, description is given of the processing of the first significantcontrol stage.

First, at a time point t127, the data collection means 24 executes theprocessing 112 to cause the storage means 23 to store the data necessaryfor calculating the control amount regarding the first significantengine control in the storage area for data necessary for calculation243.

Next, at a time point t128, the data transmission/reception means 21executes the processing 141 to transmit, via the network 10, the datanecessary for calculating the control amount regarding the firstsignificant engine control to the meter control device 30 and the ATcontrol device 40.

Next, at a time point t129, the data transmission/reception means 31 andthe data saving means 34 execute the processing 122, and, at the sametime, the data transmission/reception means 41 and the data saving means44 execute the processing 132. The data transmission/reception means 31and the data saving means 34 cause the storage means 33 to store thereceived data necessary for calculating the control amount regarding thefirst significant engine control in the storage area for data necessaryfor calculation 343. Further, the data transmission/reception means 41and the data saving means 44 cause the storage means 43 to store thereceived data necessary for calculating the control amount regarding thefirst significant engine control in the storage area for data necessaryfor calculation 443.

Next, at a time point t130, the control amount calculation means 25, thecontrol amount calculation means 35, and the control amount calculationmeans 45 simultaneously execute the processing 114, the processing 123,and the processing 133, respectively. The control amount calculationmeans 25 calculates the control amount regarding the first significantengine control based on the data necessary for calculating the controlamount regarding the first significant engine control and the controlamount calculating procedure for first significant engine control 232,which are stored in the storage means 23. Further, the control amountcalculation means 35 calculates the control amount regarding the firstsignificant engine control based on the data necessary for calculatingthe control amount regarding the first significant engine control andthe control amount calculating procedure for first significant enginecontrol 232, which are stored in the storage means 33. Further, thecontrol amount calculation means 45 calculates the control amountregarding the first significant engine control based on the datanecessary for calculating the control amount regarding the firstsignificant engine control and the control amount calculating procedurefor first significant engine control 232, which are stored in thestorage means 43.

Next, at a time point t131, the data transmission/reception means 31executes the processing 124 to transmit the control amount regarding thefirst significant engine control, which is calculated in the processing123, to the engine control device 20 via the network 10.

Next, at a time point t132, the data transmission/reception means 21executes the processing 115 to receive the control amount regarding thefirst significant engine control, which is transmitted via the network10 from the meter control device 30.

Next, at a time point t133, the data transmission/reception means 41executes the processing 134 to transmit the control amount regarding thefirst significant engine control, which is calculated in the processing133, to the engine control device 20 via the network 10.

Next, at a time point t134, the data transmission/reception means 21executes the processing 142 to receive the control amount regarding thefirst significant engine control, which is transmitted via the network10 from the AT control device 40.

Next, at a time point t135, the comparison means 26 executes theprocessing 143 to compare the control amount regarding the firstsignificant engine control, which is calculated in the processing 114,and the control amounts regarding the first significant engine control,which are received in the processing 115 and the processing 142. Here,because there is no abnormality in any of the control amount calculationmeans 25, the control amount calculation means 35, and the controlamount calculation means 45, the control amounts regarding the firstsignificant engine control have the same value. Accordingly, thecomparison means 26 outputs the control amount regarding the firstsignificant engine control to the engine control means 27.

Next, at a time point t136, the engine control means 27 executes theprocessing 117 to execute the control of the engine unit 200 based onthe control amount regarding the first significant engine control, whichhas been input from the comparison means 26.

Next, referring to the timing chart of FIG. 14, description is given ofoperation of the control system, which is performed in a case wherethere is an abnormality in any one of the control amount calculationmeans 25, the control amount calculation means 35, and the controlamount calculation means 45.

It should be noted that because the processing of the synchronizationstage and the processing from the time point t127 to the time point t129of the first significant control stage are the same as theabove-mentioned processing performed in a case where there is noabnormality in the control amount calculation means 25, the controlamount calculation means 35, and the control amount calculation means45, description thereof is omitted.

First, at the time point t130, the control amount calculation means 25,the control amount calculation means 35, and the control amountcalculation means 45 simultaneously execute the processing 114, theprocessing 123, and the processing 133, respectively. The control amountcalculation means 25 calculates the control amount regarding the firstsignificant engine control based on the data necessary for calculatingthe control amount regarding the first significant engine control andthe control amount calculating procedure for first significant enginecontrol 232, which are stored in the storage means 23. Here, if there isan abnormality in the control amount calculation means 25, for example,the calculated control amount regarding the first significant enginecontrol has a different value from the control amount that is to beobtained originally.

Further, the control amount calculation means 35 calculates the controlamount regarding the first significant engine control based on the datanecessary for calculating the control amount regarding the firstsignificant engine control and the control amount calculating procedurefor first significant engine control 232, which are stored in thestorage means 33. Further, the control amount calculation means 45calculates the control amount regarding the first significant enginecontrol based on the data necessary for calculating the control amountregarding the first significant engine control and the control amountcalculating procedure for first significant engine control 232, whichare stored in the storage means 43.

It should be noted that the processing from the time point t131 to thetime point t134 of the first significant control stage is also the sameas the above-mentioned processing performed in a case where there is noabnormality in the control amount calculation means 25, the controlamount calculation means 35, and the control amount calculation means45, and hence description thereof is omitted.

Next, at the time point t135, the comparison means 26 executes theprocessing 143 to compare the control amount regarding the firstsignificant engine control, which is calculated in the processing 114,and the control amounts regarding the first significant engine control,which are received in the processing 115 and the processing 142. Here,because there is an abnormality in the control amount calculation means25, the control amount regarding the first significant engine control,which is calculated by the control amount calculation means 25, has adifferent value from the control amounts regarding the first significantengine control, which are calculated by the control amount calculationmeans 35 and the control amount calculation means 45.

However, because there is no abnormality in the control amountcalculation means 35 and the control amount calculation means 45, thecontrol amounts regarding the first significant engine control, whichare calculated by the control amount calculation means 35 and thecontrol amount calculation means 45, have the same value. Accordingly,the comparison means 26 outputs to the engine control means 27 thecontrol amount regarding the first significant engine control, which iscalculated by each of the control amount calculation means 35 and thecontrol amount calculation means 45.

It should be noted that in a case where there is an abnormality in atleast two of the control amount calculation means 25, the control amountcalculation means 35, and the control amount calculation means 45, andall the control amounts regarding the first significant engine controlare different, the comparison means 26 outputs to the engine controlmeans 27 a notification indicating that the control amounts aredifferent.

Next, at the time point t136, the engine control means 27 executes theprocessing 117 to execute the control of the engine unit 200 based onthe control amount regarding the first significant engine control, whichis calculated by each of the control amount calculation means 35 and thecontrol amount calculation means 45, and is then input from thecomparison means 26.

In this manner, by comparing and examining the control amount regardingthe first significant engine control, which is calculated by the controlamount calculation means 25, the control amount regarding the firstsignificant engine control, which is calculated by the control amountcalculation means 35, and the control amount regarding the firstsignificant engine control, which is calculated by the control amountcalculation means 45, it is possible to detect whether or not there isan abnormality in any one of the control amount calculation means 25,the control amount calculation means 35, and the control amountcalculation means 45.

Specifically, by comparing the control amount regarding the firstsignificant engine control, which is calculated by the control amountcalculation means 25, the control amount regarding the first significantengine control, which is calculated by the control amount calculationmeans 35, and the control amount regarding the first significant enginecontrol, which is calculated by the control amount calculation means 45,the control of the engine unit 200 is executed as follows. When all thecontrol amounts have the same value, the control of the engine unit 200is executed based on this control amount regarding the first significantengine control. When two of the control amounts have the same value, thecontrol of the engine unit 200 is executed based on the control amountregarding the first significant engine control, which represents the twosame control amounts. As a result, it is possible to reduce the cost ofthe control system while securing the reliability of the control withoutproviding two microcomputers or a monitoring circuit within the enginecontrol device 20.

Further, while the control amount regarding the first significant enginecontrol is being calculated in the engine control device 20 (originalcalculation), the corresponding control amounts are simultaneouslycalculated by the control amount calculation means 35 of the metercontrol device 30 and the control amount calculation means 45 of the ATcontrol device 40, to thereby compare results of the calculations. Then,when all the control amounts or two of the control amounts have the samevalue, the control of the engine unit 200 is executed based on thecontrol amount regarding the first significant engine control, whichrepresents the same value. As a result, at the time of carrying out notthe calculation for the abnormality detection but the originalcalculation, it is possible to judge whether or not there is anabnormality, thereby securing the reliability of the control.

As described above, according to the fourth embodiment, there areprovided a first control device, a second control device, and a thirdcontrol device, which are connected to a network in which timesynchronization is possible between nodes connected thereto. The firstcontrol device includes: first control amount calculation means forcalculating a control amount regarding a first significant control basedon a first control amount calculating procedure for calculating thecontrol amount regarding the first significant control, and data forfirst control necessary for calculating the control amount regarding thefirst significant control for a control target of the first controldevice; comparison means for comparing the control amount regarding thefirst significant control, which is calculated by the first controlamount calculation means, a control amount regarding the firstsignificant control, which is calculated by the second control device,and a control amount regarding the first significant control, which iscalculated by the third control device; and control means forcontrolling the control target based on a result of the comparison madeby the comparison means. The second control device includes secondstorage means for storing the first control amount calculating procedureand the data for first control, which is received from the first controldevice via the network, and second control amount calculation means forcalculating the control amount regarding the first significant controlbased on the first control amount calculating procedure and the data forfirst control. The third control device includes third storage means forstoring the first control amount calculating procedure and the data forfirst control, which is received from the first control device via thenetwork, and third control amount calculation means for calculating thecontrol amount regarding the first significant control based on thefirst control amount calculating procedure and the data for firstcontrol.

Therefore, without providing two microcomputers having the samefunctions or a monitoring circuit within the control device, bycomparing and examining the control amount regarding the firstsignificant control, which is calculated by the first control amountcalculation means, the control amount regarding the first significantcontrol, which is calculated by the second control device, and thecontrol amount regarding the first significant control, which iscalculated by the third control device, it is possible to obtain acontrol system capable of reducing the cost while securing thereliability of the control.

Further, when the comparison means judges that all the compared controlamounts regarding the first significant control have the same value, thecontrol means controls the control target based on the control amountregarding the first significant control, which represents the samevalue. When the comparison means judges that all the compared controlamounts regarding the first significant control have different values,the control means does not control the control target. Further, when thecomparison means judges that not all of the compared control amountsregarding the first significant control have the same value but two ofthe control amounts have the same value, the control means controls thecontrol target based on the control amount regarding the firstsignificant control, which represents the same value. Therefore, thereliability of the control can be improved.

Here, in the fourth embodiment described above, there has been given thedescription in which, when the notification indicating that the controlamounts are different has been input from the comparison means 26, theengine control means 27 does not execute the control of the engine unit200. However, the present invention is not limited thereto. When thenotification indicating that the control amounts are different has beeninput from the comparison means 26, the engine control means 27 mayexecute the control of the engine unit 200 based on a predeterminedcontrol amount previously set as a control amount regarding the firstsignificant engine control. Further, instead of the predeterminedcontrol amount that is set previously, the engine control means 27 mayuse the control amount calculated last time.

In this case, even if an abnormality has occurred in any one of thecontrol amount calculation means 25, the control amount calculationmeans 35, and the control amount calculation means 45, it is possible tocontinue the control without stopping the engine.

Further, in the fourth embodiment described above, the control amountcalculation means 25, the control amount calculation means 35, and thecontrol amount calculation means 45 may have an identical configurationby, for example, using microcomputers of the same model number from thesame manufacturer.

In this case, the control amounts can be calculated more accurately. Inaddition, by executing the control of the engine unit 200 based onresults obtained through comparison among such control amounts, it ispossible to improve the reliability of the control.

Further, in the fourth embodiment described above, the storage means 23,the storage means 33, and the storage means 43 may have an identicalconfiguration by, for example, using memories of the same model numberfrom the same manufacturer. Then, the control amount calculatingprocedure for first significant engine control 232 may be stored at thesame location of each of the memories.

In this case, the control amounts can be calculated more accurately. Inaddition, by executing the control of the engine unit 200 based onresults obtained through comparison among such control amounts, it ispossible to improve the reliability of the control.

Further, in the fourth embodiment described above, the storage means 23,the storage means 33, and the storage means 43 may have an identicalconfiguration by, for example, using memories of the same model numberfrom the same manufacturer. Then, the storage area for data necessaryfor calculation 243, the storage area for data necessary for calculation343, and the storage area for data necessary for calculation 443, inwhich data necessary for calculating a control amount regarding thefirst significant engine control is stored, may be located at the samelocation of each of the memories.

In this case, the control amounts can be calculated more accurately. Inaddition, by executing the control of the engine unit 200 based onresults obtained through comparison among such control amounts, it ispossible to improve the reliability of the control.

Further, in the fourth embodiment described above, there has been giventhe description of the case where an abnormality occurs in the controlamount calculation means 25. According to the fourth embodiment, even ifunintended data change, data corruption, or the like has occurred afterthe data necessary for calculating a control amount regarding the firstsignificant engine control is transmitted to the meter control device 30or the AT control device 40 by the data transmission/reception means 21,it is possible to improve the reliability of the control by executingthe control of the engine unit 200 based on results obtained throughcomparison among the calculated control amounts.

Fifth Embodiment

In the third and fourth embodiment described above, two or more controldevices calculate control amounts regarding the first significant enginecontrol to compare the calculated control amounts. However, the presentinvention is not limited thereto. Two or more control devices may eachcalculate control amounts regarding two or more significant controls tocompare the calculated control amounts.

The node configuration of the control system according to the fifthembodiment of the present invention is the same as in FIG. 12 of thefourth embodiment, and hence description thereof is omitted.

Here, referring to FIG. 7, detailed description is given of the storagemeans 23 of the engine control device 20. It should be noted thatdescription of the same configuration as in FIG. 2 of the thirdembodiment is omitted.

In FIG. 7, the ROM area 230 of the storage means 23 contains the otherROM data 231, the control amount calculating procedure for firstsignificant engine control 232, the control amount calculating procedurefor normal engine control 233, and a control amount calculatingprocedure for second significant engine control 235 (second controlamount calculating procedure).

The control amount calculating procedure for second significant enginecontrol 235 indicates a procedure for calculating a control amountregarding the second significant engine control (second significantcontrol), and indicates a procedure that is different from the procedureindicated by the control amount calculating procedure for firstsignificant engine control 232.

Here, the second significant engine control refers to such control thatmay endanger the vehicle, the driver, the surroundings of the vehicle,etc. depending on a calculation result, and therefore refers to suchcontrol that requires high reliability.

Next, referring to FIG. 8, detailed description is given of the storagemeans 43 of the AT control device 40. It should be noted thatdescription of the same configuration as in FIG. 13 of the fourthembodiment is omitted.

In FIG. 8, the ROM area 430 of the storage means 43 contains other ROMdata 431, a control amount calculating procedure for AT control 433, afree area 434, and a control amount calculating procedure for secondsignificant engine control 235.

The control amount calculating procedure for second significant enginecontrol 235 indicates a procedure for calculating a control amountregarding the second significant engine control, and the storage means23 and the storage means 43 each store the same control amountcalculating procedure for second significant engine control 235.

Hereinbelow, referring to a timing chart of FIG. 15, description isgiven of operation of the control system according to the fifthembodiment of the present invention. Here, description is given ofprocessing related to the first significant engine control and thesecond significant engine control.

In FIG. 15, the horizontal axes represent engine control device time,which indicates the flow of time in the engine control device 20, metercontrol device time, which indicates the flow of time in the metercontrol device 30, AT control device time, which indicates the flow oftime in the AT control device 40, and network time, which indicates theflow of time in the network 10.

Further, in FIG. 15, the engine control device 20 executes, in additionto the processing of from the processing 111 to the processing 117illustrated in FIG. 11, processing of from processing 151 to processing156. Further, the AT control device 40 executes, instead of theprocessing of from the processing 132 to the processing 134 illustratedin FIG. 14, processing of from processing 161 to processing 163.

Here, the rest of the processing is the same as in the third or fourthembodiment, and hence description thereof is omitted.

Here, the processing 111, the processing 121, and the processing 131 arethe processing of the synchronization stage. The processing of from theprocessing 112 to the processing 117, and from the processing 122 to theprocessing 124 is processing of the first significant control stage. Onthe other hand, the processing of from the processing 151 to theprocessing 156, and from the processing 161 to the processing 163 isprocessing of a second significant control stage.

It should be noted that the processing of the synchronization stage isnot executed routinely, but is executed when the engine control devicetime, the meter control device time, and the AT control device time needto be synchronized with the network time, such as after the boot-up orthe initialization of each control device. Further, the processing ofthe first significant control stage is repeatedly executed every timethe processing related to the first significant engine control isperformed, whereas the processing of the second significant controlstage is repeatedly executed every time the processing related to thesecond significant engine control is performed.

Next, description is given of the processing of from the processing 151to the processing 156 performed by the engine control device 20.

In the processing 151, the data collection means 24 collects datanecessary for calculating a control amount regarding the secondsignificant engine control (data for second control), and then causesthe storage means 23 to store the collected data in the storage area fordata necessary for calculation 243.

In the processing 152, the data transmission/reception means 21transmits, to the AT control device 40, the data necessary forcalculating a control amount regarding the second significant enginecontrol.

In the processing 153, the control amount calculation means 25calculates the control amount regarding the second significant enginecontrol based on the data necessary for calculating the control amountregarding the second significant engine control and the control amountcalculating procedure for second significant engine control 235, whichare stored in the storage means 23.

In the processing 154, the data transmission/reception means 21 receivesthe control amount regarding the second significant engine control,which is transmitted from the AT control device 40.

In the processing 155, the comparison means 26 compares the controlamount regarding the second significant engine control, which iscalculated in the processing 153, and the control amount regarding thesecond significant engine control, which is received in the processing154. Then, when the two control amounts have the same value, thecomparison means 26 outputs the control amount regarding the secondsignificant engine control to the engine control means 27. When the twocontrol amounts have different values, the comparison means 26 outputsto the engine control means 27 a notification indicating that thecontrol amounts are different.

In the processing 156, the engine control means 27 executes the controlof the engine unit 200 based on a result of the comparison made by thecomparison means 26. Specifically, when the control amount regarding thesecond significant engine control has been input from the comparisonmeans 26, the engine control means 27 executes the control of the engineunit 200 based on this control amount. When the notification indicatingthat the control amounts are different has been input from thecomparison means 26, the engine control means 27 does not execute thecontrol of the engine unit 200.

Next, description is given of the processing of from the processing 161to the processing 163 performed by the AT control device 40.

In the processing 161, the data transmission/reception means 41 receivesthe data necessary for calculating the control amount regarding thesecond significant engine control, which is transmitted from the enginecontrol device 20. Then, the data saving means 44 causes the storagemeans 43 to store the received data in the storage area for datanecessary for calculation 443.

In the processing 162, the control amount calculation means 45calculates the control amount regarding the second significant enginecontrol based on the data necessary for calculating the control amountregarding the second significant engine control and the control amountcalculating procedure for second significant engine control 235, whichare stored in the storage means 43.

In the processing 163, the data transmission/reception means 41transmits, to the engine control device 20, the control amount regardingthe second significant engine control, which is calculated in theprocessing 162.

It should be noted that, in the engine control device 20, after theprocessing 111, the engine control device time and the network time areidentical due to the synchronization. Further, in the meter controldevice 30, after the processing 121, the meter control device time andthe network time are identical due to the synchronization. Further, inthe AT control device 40, after the processing 131, the AT controldevice time and the network time are identical due to thesynchronization.

In the timing chart illustrated in FIG. 15, only the processing relatedto the first significant engine control and the processing related tothe second significant engine control are illustrated for the purpose ofclarifying the features of the fifth embodiment. However, in actuality,not only these processings, there exist processing related to the normalengine control, processing related to the meter control and processingrelated to the AT control in the engine control device 20, in the metercontrol device 30, and in the AT control device 40, respectively. Theseprocessings are executed in each of the control devices during the freetime in which the processing related to the first significant enginecontrol (processing of the first significant control stage andprocessing of the second significant control stage illustrated in FIG.15) is not executed.

Next, referring to the timing chart of FIG. 15, description is given ofoperation of the control system, which is performed in a case wherethere is no abnormality in the control amount calculation means 25, thecontrol amount calculation means 35, and the control amount calculationmeans 45, enabling the control amount regarding the first significantengine control and the control amount regarding the second significantengine control to be calculated accurately.

First, description is given of the processing of the synchronizationstage.

First, the engine control device 20 is booted by a time point t141, and,at the time point t141, the time synchronization means 28 executes theprocessing 111. In the engine control device 20, after a time pointt142, at which the processing 111 ends, the engine control device timeand the network time are identical due to the synchronization.

Next, the meter control device 30 is booted by a time point t143, and,at the time point t143, the time synchronization means 38 executes theprocessing 121. In the meter control device 30, after a time point t144,at which the processing 121 ends, the meter control device time and thenetwork time are identical due to the synchronization.

Next, the AT control device 40 is booted by a time point t145, and, atthe time point t145, the time synchronization means 47 executes theprocessing 131. In the AT control device 40, after a time point t146, atwhich the processing 131 ends, the AT control device time and thenetwork time are identical due to the synchronization.

Next, description is given of the processing of the first significantcontrol stage.

First, at a time point t147, the data collection means 24 executes theprocessing 112 to cause the storage means 23 to store the data necessaryfor calculating the control amount regarding the first significantengine control in the storage area for data necessary for calculation243.

Next, at a time point t148, the data transmission/reception means 21executes the processing 113 to transmit, via the network 10, the datanecessary for calculating the control amount regarding the firstsignificant engine control to the meter control device 30.

Next, at a time point t149, the data transmission/reception means 31 andthe data saving means 34 execute the processing 122 to cause the storagemeans 33 to store the received data necessary for calculating thecontrol amount regarding the first significant engine control in thestorage area for data necessary for calculation 343.

Next, at a time point t150, the control amount calculation means 25 andthe control amount calculation means 35 simultaneously execute theprocessing 114 and the processing 123, respectively. The control amountcalculation means 25 and the control amount calculation means 35calculate control amounts regarding the first significant engine controlbased on the data necessary for calculating the control amount regardingthe first significant engine control and the control amount calculatingprocedure for first significant engine control 232, which are stored inthe storage means 23 and the storage means 33, respectively.

Next, at a time point t151, the data transmission/reception means 31executes the processing 124 to transmit the control amount regarding thefirst significant engine control, which is calculated in the processing123, to the engine control device 20 via the network 10.

Next, at a time point t152, the data transmission/reception means 21executes the processing 115 to receive the control amount regarding thefirst significant engine control, which is transmitted via the network10 from the meter control device 30.

Next, at a time point t153, the comparison means 26 executes theprocessing 116 to compare the control amount regarding the firstsignificant engine control, which is calculated in the processing 114,and the control amount regarding the first significant engine control,which is received in the processing 115. Here, because there is noabnormality in both of the control amount calculation means 25 and thecontrol amount calculation means 35, the control amounts regarding thefirst significant engine control have the same value. Accordingly, thecomparison means 26 outputs the control amount regarding the firstsignificant engine control to the engine control means 27.

Next, at a time point t154, the engine control means 27 executes theprocessing 117 to execute the control of the engine unit 200 based onthe control amount regarding the first significant engine control, whichhas been input from the comparison means 26.

Next, description is given of the processing of the second significantcontrol stage.

First, at a time point t155, the data collection means 24 executes theprocessing 151 to cause the storage means 23 to store the data necessaryfor calculating the control amount regarding the second significantengine control in the storage area for data necessary for calculation243.

Next, at a time point t156, the data transmission/reception means 21executes the processing 152 to transmit, via the network 10, the datanecessary for calculating the control amount regarding the secondsignificant engine control to the AT control device 40.

Next, at a time point t157, the data transmission/reception means 41 andthe data saving means 44 execute the processing 161 to cause the storagemeans 43 to store, in the storage area for data necessary forcalculation 443, the received data necessary for calculating the controlamount regarding the second significant engine control.

Next, at a time point t158, the control amount calculation means 25 andthe control amount calculation means 45 simultaneously execute theprocessing 153 and the processing 162, respectively. The control amountcalculation means 25 and the control amount calculation means 45calculate control amounts regarding the second significant enginecontrol based on the data necessary for calculating the control amountregarding the second significant engine control and the control amountcalculating procedure for second significant engine control 235, whichare stored in the storage means 23 and the storage means 43,respectively.

Next, at a time point t159, the data transmission/reception means 41executes the processing 163 to transmit the control amount regarding thesecond significant engine control, which is calculated in the processing162, to the engine control device 20 via the network 10.

Next, at a time point t160, the data transmission/reception means 21executes the processing 154 to receive the control amount regarding thesecond significant engine control, which is transmitted via the network10 from the AT control device 40.

Next, at a time point t161, the comparison means 26 executes theprocessing 155 to compare the control amount regarding the secondsignificant engine control, which is calculated in the processing 153,and the control amount regarding the second significant engine control,which is received in the processing 154. Here, because there is noabnormality in both of the control amount calculation means 25 and thecontrol amount calculation means 45, the control amounts regarding thesecond significant engine control have the same value. Accordingly, thecomparison means 26 outputs the control amount regarding the secondsignificant engine control to the engine control means 27.

Next, at a time point t162, the engine control means 27 executes theprocessing 156 to execute the control of the engine unit 200 based onthe control amount regarding the second significant engine control,which has been input from the comparison means 26.

Next, with reference to the timing chart of FIG. 15, description isgiven of operation of the control system, which is performed in a casewhere there is an abnormality in any one of the control amountcalculation means 25, the control amount calculation means 35, and thecontrol amount calculation means 45. Here, the description is given bytaking as an example a case where, due to an abnormality in the controlamount calculation means 25, only the control amount regarding thesecond significant engine control cannot be calculated accurately whilethe control amount regarding the first significant engine control can becalculated accurately.

It should be noted that because the processing of the synchronizationstage, the processing of the first significant control stage, and theprocessing from the time point t155 to the time point t157 of the secondsignificant control stage are the same as the above-mentioned processingperformed in the case where there is no abnormality in the controlamount calculation means 25, the control amount calculation means 35,and the control amount calculation means 45, description thereof isomitted.

First, at the time point t158, the control amount calculation means 25and the control amount calculation means 45 simultaneously execute theprocessing 153 and the processing 162, respectively. The control amountcalculation means 25 calculates the control amount regarding the secondsignificant engine control based on the data necessary for calculatingthe control amount regarding the second significant engine control andthe control amount calculating procedure for second significant enginecontrol 235, which are stored in the storage means 23. Here, because,due to an abnormality in the control amount calculation means 25, onlythe control amount regarding the second significant engine controlcannot be calculated accurately, the calculated control amount regardingthe second significant engine control has a different value from thecontrol amount that is to be obtained originally.

Further, the control amount calculation means 45 calculates the controlamount regarding the second significant engine control based on the datanecessary for calculating the control amount regarding the secondsignificant engine control and the control amount calculating procedurefor second significant engine control 235, which are stored in thestorage means 43.

It should be noted that the processing from the time point t159 to thetime point t160 of the second significant control stage is also the sameas the above-mentioned processing performed in the case where there isno abnormality in the control amount calculation means 25, the controlamount calculation means 35, and the control amount calculation means45, and hence description thereof is omitted.

Next, at the time point t161, the comparison means 26 executes theprocessing 155 to compare the control amount regarding the secondsignificant engine control, which is calculated in the processing 153,and the control amount regarding the second significant engine control,which is received in the processing 154. Here, because there is anabnormality in the control amount calculation means 25, the controlamounts regarding the second significant engine control have differentvalues. Accordingly, the comparison means 26 outputs to the enginecontrol means 27 the notification indicating that the control amountsare different.

Next, at the time point t162, the engine control means 27 executes theprocessing 156. However, due to input of the notification indicatingthat the control amounts are different from the comparison means 26, theengine control means 27 does not execute the control of the engine unit200.

In this manner, by comparing the control amount regarding the firstsignificant engine control, which is calculated by the control amountcalculation means 25, and the control amount regarding the firstsignificant engine control, which is calculated by the control amountcalculation means 35, and comparing and examining the control amountregarding the second significant engine control, which is calculated bythe control amount calculation means 25, and the control amountregarding the second significant engine control, which is calculated bythe control amount calculation means 45, it is possible to detectwhether or not there is an abnormality in any one of the control amountcalculation means 25, the control amount calculation means 35, and thecontrol amount calculation means 45.

Specifically, by comparing the control amount regarding the firstsignificant engine control, which is calculated by the control amountcalculation means 25, and the control amount regarding the firstsignificant engine control, which is calculated by the control amountcalculation means 35, and comparing the control amount regarding thesecond significant engine control, which is calculated by the controlamount calculation means 25, and the control amount regarding the secondsignificant engine control, which is calculated by the control amountcalculation means 45, and, when the respective pairs of the controlamounts have the same values, executing the control of the engine unit200 based on the respective control amounts, and, when at least one pairof the control amounts has different values, avoiding executing thecontrol of the engine unit 200 for both the significant controls, it ispossible to reduce the cost of the control system while securing thereliability of the control without providing two microcomputers or amonitoring circuit within the engine control device 20.

Further, while the control amount regarding the first significant enginecontrol or the control amount regarding the second significant enginecontrol is being calculated in the engine control device 20 (originalcalculation), the corresponding control amounts are simultaneouslycalculated by the control amount calculation means 35 of the metercontrol device 30 and the control amount calculation means 45 of the ATcontrol device 40, to thereby compare results of the calculations. Then,when at least one pair of the control amounts has the same value, thecontrol of the engine unit 200 is executed only for the firstsignificant engine control or the second significant engine control, forwhich the control amounts have the same value. As a result, at the timeof carrying out not the calculation for the abnormality detection butthe original calculation, it is possible to judge whether or not thereis an abnormality, thereby securing the reliability of the control.

As described above, according to the fifth embodiment, there areprovided a first control device, a second control device, and a thirdcontrol device, which are connected to a network in which timesynchronization is possible between nodes connected thereto. The firstcontrol device includes: first control amount calculation means forcalculating a control amount regarding a first significant control and acontrol amount regarding a second significant control based on a firstcontrol amount calculating procedure for calculating the control amountregarding the first significant control, a second control amountcalculating procedure for calculating the control amount regarding thesecond significant control, data for first control necessary forcalculating the control amount regarding the first significant controlfor a control target of the first control device, and data for secondcontrol necessary for calculating the control amount regarding thesecond significant control for the control target of the first controldevice; comparison means for comparing the control amount regarding thefirst significant control, which is calculated by the first controlamount calculation means, and the control amount regarding the firstsignificant control, which is calculated by the second control device,and comparing the control amount regarding the second significantcontrol, which is calculated by the first control amount calculationmeans, and the control amount regarding the second significant control,which is calculated by the third control device; and control means forcontrolling the control target based on results of the comparison madeby the comparison means. The second control device includes secondstorage means for storing the first control amount calculating procedureand the data for first control, which is received from the first controldevice via the network, and second control amount calculation means forcalculating the control amount regarding the first significant controlbased on the first control amount calculating procedure and the data forfirst control. The third control device includes third storage means forstoring the second control amount calculating procedure and the data forsecond control, which is received from the first control device via thenetwork, and third control amount calculation means for calculating thecontrol amount regarding the second significant control based on thesecond control amount calculating procedure and the data for secondcontrol.

Therefore, without providing two microcomputers having the samefunctions or a monitoring circuit within the control device, bycomparing the control amount regarding the first significant control,which is calculated by the first control amount calculation means, andthe control amount regarding the first significant control, which iscalculated by the second control device, and comparing and examining thecontrol amount regarding the second significant control, which iscalculated by the first control amount calculation means, and thecontrol amount regarding the second significant control, which iscalculated by the third control device, it is possible to obtain acontrol system capable of reducing the cost while securing thereliability of the control.

Further, when the comparison means judges that the compared controlamounts regarding the first significant control and the compared controlamounts regarding the second significant control have the same values,respectively, the control means controls the control target based on thecontrol amounts regarding the first significant control having the samevalue and the control amounts regarding the second significant controlhaving the same value. When the comparison means judges that at leastone of a pair of the compared control amounts regarding the firstsignificant control and a pair of the compared control amounts regardingthe second significant control has different values, the control meansdoes not control the control target. Further, when the comparison meansjudges that at least one of a pair of the compared control amountsregarding the first significant control and a pair of the comparedcontrol amounts regarding the second significant control has differentvalues, the control device controls the control target only for thefirst significant control or the second significant control, for whichthe control amounts have the same value. Therefore, the reliability ofthe control can be improved.

Here, in the fifth embodiment described above, there has been given thedescription in which, when the notification indicating that the controlamounts are different has been input from the comparison means 26, theengine control means 27 does not execute the control of the engine unit200. However, the present invention is not limited thereto. When thenotification indicating that the control amounts are different has beeninput from the comparison means 26, the engine control means 27 mayexecute the control of the engine unit 200 with regard to thesignificant control for which the control amounts are different or withregard to both the significant controls, based on predetermined controlamounts previously set as a control amount regarding the firstsignificant engine control and a control amount regarding the secondsignificant engine control, respectively. Further, instead of thepredetermined control amounts, the engine control means 27 may use thecontrol amount calculated last time.

In this case, even if an abnormality has occurred in any one of thecontrol amount calculation means 25, the control amount calculationmeans 35, and the control amount calculation means 45, it is possible tocontinue the control without stopping the engine.

Further, in the fifth embodiment described above, the control amountcalculation means 25, the control amount calculation means 35, and thecontrol amount calculation means 45 may have an identical configurationby, for example, using microcomputers of the same model number from thesame manufacturer.

In this case, the control amounts can be calculated more accurately. Inaddition, by executing the control of the engine unit 200 based onresults obtained through comparison among such control amounts, it ispossible to improve the reliability of the control.

Further, in the fifth embodiment described above, the storage means 23,the storage means 33, and the storage means 43 may have an identicalconfiguration by, for example, using memories of the same model numberfrom the same manufacturer. Then, the control amount calculatingprocedure for first significant engine control 232 may be stored at thesame location of each of the storage means 23 and the storage means 33.The control amount calculating procedure for second significant enginecontrol 235 may be stored at the same location of each of the storagemeans 23 and the storage means 43.

In this case, the control amounts can be calculated more accurately. Inaddition, by executing the control of the engine unit 200 based onresults obtained through comparison among such control amounts, it ispossible to improve the reliability of the control.

Further, in the fifth embodiment described above, the storage means 23,the storage means 33, and the storage means 43 may have an identicalconfiguration by, for example, using memories of the same model numberfrom the same manufacturer. Then, the storage area for data necessaryfor calculation 243 and the storage area for data necessary forcalculation 343, in which data necessary for calculating a controlamount regarding the first significant engine control is stored, may belocated at the same location of each of the storage means 23 and thestorage means 33. The storage area for data necessary for calculation243 and the storage area for data necessary for calculation 443, inwhich data necessary for calculating a control amount regarding thesecond significant engine control is stored, may be located at the samelocation of each of the storage means 23 and the storage means 43.

In this case, the control amounts can be calculated more accurately. Inaddition, by executing the control of the engine unit 200 based onresults obtained through comparison among such control amounts, it ispossible to improve the reliability of the control.

Further, in the fifth embodiment described above, there has been giventhe description of the case where an abnormality occurs in the controlamount calculation means 25. According to the fifth embodiment, even ifunintended data change, data corruption, or the like has occurred afterthe data necessary for calculating a control amount regarding the firstsignificant engine control is transmitted to the meter control device 30by the data transmission/reception means 21 or after the data necessaryfor calculating a control amount regarding the second significant enginecontrol is transmitted to the AT control device 40 by the datatransmission/reception means 21, it is possible to improve thereliability of the control by executing the control of the engine unit200 based on results obtained through comparison among the calculatedcontrol amounts.

Further, in the fourth and fifth embodiment described above, there hasbeen given the description by taking as an example the case where threecontrol devices are used, but the present invention is not limitedthereto. Even if four or more control devices are used, the same effectcan be obtained.

Further, in the third to fifth embodiments described above, the storagemeans and the control amount calculation means are described as beingseparate components, but the present invention is not limited thereto.Even if a storage area is provided inside the control amount calculationmeans, the same effect can be obtained.

What is claimed is:
 1. A control system, comprising a plurality ofcontrol devices for controlling different control targets, respectively,the plurality of control devices each being connected to a network inwhich time synchronization is possible between nodes connected thereto,the plurality of control devices comprising a first control device and asecond control device and subsequent control devices, wherein: the firstcontrol device and the second control device and the subsequent controldevices each store a control amount calculating procedure forcalculating a control amount regarding a significant control having ahigher degree of significance than at least one other control amongcontrols to be performed on the control target of the first controldevice; and the first control device compares a control amount regardingthe significant control, which is calculated by the first controldevice, and a control amount regarding the significant control, which iscalculated, after synchronization with the first control device, by oneof the second control device and the subsequent control devices, tothereby control the control target of the first control device based ona result of the comparison, wherein the first control device and the oneof the second and subsequent control devices calculate the respectivecontrol amounts simultaneously, and wherein the one of the second andsubsequent control devices calculates the control amount based on datawhich is transmitted to it from the first control device.
 2. A controlsystem according to claim 1, wherein: the plurality of control devicescomprise the first control device and a second control device, which areconnected to the network; the first control device comprises: first timesynchronization means for achieving the time synchronization with thenetwork; first storage means for storing a first control amountcalculating procedure for calculating a control amount regarding a firstsignificant control for the control target of the first control deviceand data for first control necessary for calculating the control amountregarding the first significant control; data collection means forcollecting the data for first control to store the data for firstcontrol in the first storage means; first control amount calculationmeans for calculating the control amount regarding the first significantcontrol based on the first control amount calculating procedure and thedata for first control, which are stored in the first storage means;comparison means for comparing the control amount regarding the firstsignificant control, which is calculated by the first control amountcalculation means, and a control amount regarding the first significantcontrol, which is calculated by the second control device; and controlmeans for controlling the control target based on a result of thecomparison made by the comparison means; and the second control devicecomprises: second time synchronization means for achieving the timesynchronization with the network; second storage means for storing thefirst control amount calculating procedure and the data for firstcontrol; second saving means for causing the second storage means tostore the data for first control, which is received from the firstcontrol device via the network; and second control amount calculationmeans for calculating the control amount regarding the first significantcontrol based on the first control amount calculating procedure and thedata for first control, which are stored in the second storage means. 3.A control system according to claim 1, wherein: the plurality of controldevices comprise the first control device, a second control device, anda third control device, which are connected to the network; the firstcontrol device comprises: first time synchronization means for achievingthe time synchronization with the network; first storage means forstoring a first control amount calculating procedure for calculating acontrol amount regarding a first significant control for the controltarget of the first control device, and data for first control necessaryfor calculating the control amount regarding the first significantcontrol; data collection means for collecting the data for first controlto store the data for first control in the first storage means; firstcontrol amount calculation means for calculating the control amountregarding the first significant control based on the first controlamount calculating procedure and the data for first control, which arestored in the first storage means; comparison means for comparing thecontrol amount regarding the first significant control, which iscalculated by the first control amount calculation means, a controlamount regarding the first significant control, which is calculated bythe second control device, and a control amount regarding the firstsignificant control, which is calculated by the third control device;and control means for controlling the control target based on results ofthe comparison made by the comparison means; the second control devicecomprises: second time synchronization means for achieving the timesynchronization with the network; second storage means for storing thefirst control amount calculating procedure and the data for firstcontrol; second saving means for causing the second storage means tostore the data for first control, which is received from the firstcontrol device via the network; and second control amount calculationmeans for calculating the control amount regarding the first significantcontrol based on the first control amount calculating procedure and thedata for first control, which are stored in the second storage means;and the third control device comprises: third time synchronization meansfor achieving the time synchronization with the network; third storagemeans for storing the first control amount calculating procedure and thedata for first control; third saving means for causing the third storagemeans to store the data for first control, which is received from thefirst control device via the network; and third control amountcalculation means for calculating the control amount regarding the firstsignificant control based on the first control amount calculatingprocedure and the data for first control, which are stored in the thirdstorage means.
 4. A control system according to claim 1, wherein: theplurality of control devices comprise the first control device, a secondcontrol device, and a third control device, which are connected to thenetwork; the first control device comprises: first time synchronizationmeans for achieving the time synchronization with the network; firststorage means for storing a first control amount calculating procedurefor calculating a control amount regarding a first significant controlfor the control target of the first control device, a second controlamount calculating procedure for calculating a control amount regardinga second significant control for the control target of the first controldevice, data for first control necessary for calculating the controlamount regarding the first significant control, and data for secondcontrol necessary for calculating the control amount regarding thesecond significant control; data collection means for collecting thedata for first control and the data for second control to store the datafor first control and the data for second control in the first storagemeans; first control amount calculation means for calculating thecontrol amount regarding the first significant control based on thefirst control amount calculating procedure and the data for firstcontrol, and calculating the control amount regarding the secondsignificant control based on the second control amount calculatingprocedure and the data for second control, the first control amountcalculating procedure, the data for first control, the second controlamount calculating procedure, and the data for second control beingstored in the first storage means; comparison means for comparing thecontrol amount regarding the first significant control, which iscalculated by the first control amount calculation means, and a controlamount regarding the first significant control, which is calculated bythe second control device, and comparing the control amount regardingthe second significant control, which is calculated by the first controlamount calculation means, and a control amount regarding the secondsignificant control, which is calculated by the third control device;and control means for controlling the control target based on results ofthe comparison made by the comparison means; the second control devicecomprises: second time synchronization means for achieving the timesynchronization with the network; second storage means for storing thefirst control amount calculating procedure and the data for firstcontrol; second saving means for causing the second storage means tostore the data for first control, which is received from the firstcontrol device via the network; and second control amount calculationmeans for calculating the control amount regarding the first significantcontrol based on the first control amount calculating procedure and thedata for first control, which are stored in the second storage means;and the third control device comprises: third time synchronization meansfor achieving the time synchronization with the network; third storagemeans for storing the second control amount calculating procedure andthe data for second control; third saving means for causing the thirdstorage means to store the data for second control, which is receivedfrom the first control device via the network; and third control amountcalculation means for calculating the control amount regarding thesecond significant control based on the second control amountcalculating procedure and the data for second control, which are storedin the third storage means.
 5. A control system according to claim 2,wherein, when the comparison means judges that all of the comparedcontrol amounts regarding the first significant control have the samevalue, the control means controls the control target based on thecontrol amounts regarding the first significant control having the samevalue.
 6. A control system according to claim 2, wherein, when thecomparison means judges that not all of the compared control amountsregarding the first significant control have the same value, the controlmeans avoids controlling the control target.
 7. A control systemaccording to claim 2, wherein, when the comparison means judges that notall of the compared control amounts regarding the first significantcontrol have the same value, the control means controls the controltarget based on a predetermined control amount previously set as acontrol amount regarding the first significant control.
 8. A controlsystem according to claim 3, wherein, when the comparison means judgesthat all of the compared control amounts regarding the first significantcontrol have the same value, the control means controls the controltarget based on the control amounts regarding the first significantcontrol having the same value.
 9. A control system according to claim 3,wherein, when the comparison means judges that not all of the comparedcontrol amounts regarding the first significant control have the samevalue, the control means avoids controlling the control target.
 10. Acontrol system according to claim 3, wherein, when the comparison meansjudges that not all of the compared control amounts regarding the firstsignificant control have the same value, the control means controls thecontrol target based on a predetermined control amount previously set asa control amount regarding the first significant control.
 11. A controlsystem according to claim 3, wherein, when the comparison means judgesthat not all of the compared control amounts regarding the firstsignificant control have the same value but two of the compared controlamounts regarding the first significant control have the same value, thecontrol means controls the control target based on the control amountsregarding the first significant control having the same value.
 12. Acontrol system according to claim 4, wherein, when the comparison meansjudges that the compared control amounts regarding the first significantcontrol have the same value, and that the compared control amountsregarding the second significant control have the same value, thecontrol means controls the control target based on one of the controlamounts regarding the first significant control having the same valueand the control amounts regarding the second significant control havingthe same value.
 13. A control system according to claim 4, wherein, whenthe comparison means judges that at least one of a pair of the comparedcontrol amounts regarding the first significant control and a pair ofthe compared control amounts regarding the second significant controlhas different values, the control means avoids controlling the controltarget.
 14. A control system according to claim 4, wherein, when thecomparison means judges that at least one of a pair of the comparedcontrol amounts regarding the first significant control and a pair ofthe compared control amounts regarding the second significant controlhas different values, the control means controls the control targetbased on a predetermined control amount previously set, only with regardto a significant control for which the control amounts have thedifferent values.
 15. A control system according to claim 4, wherein,when the comparison means judges that at least one of a pair of thecompared control amounts regarding the first significant control and apair of the compared control amounts regarding the second significantcontrol has different values, the control means controls the controltarget based on predetermined control amounts previously set as acontrol amount regarding the first significant control and a controlamount regarding the second significant control, respectively.
 16. Acontrol system according to claim 2, wherein the first control amountcalculation means and the second control amount calculation means eachcomprise a microcomputer of the same configuration.
 17. A control systemaccording to claim 3, wherein the first control amount calculationmeans, the second control amount calculation means, and the thirdcontrol amount calculation means each comprise a microcomputer of thesame configuration.
 18. A control system according to claim 4, whereinthe first control amount calculation means, the second control amountcalculation means, and the third control amount calculation means eachcomprise a microcomputer of the same configuration.
 19. A control systemaccording to claim 2, wherein: the first storage means and the secondstorage means each comprise a memory of the same configuration; and thefirst control amount calculating procedure and the data for firstcontrol are stored at the same location of each of the first storagemeans and the second storage means.
 20. A control system according toclaim 3, wherein: the first storage means, the second storage means, andthe third storage means each comprise a memory of the sameconfiguration; the first control amount calculating procedure and thedata for first control are stored at the same location of each of thefirst storage means and the second storage means.
 21. A control systemaccording to claim 4, wherein: the first storage means, the secondstorage means, and the third storage means each comprise a memory of thesame configuration; the first control amount calculating procedure andthe data for first control are stored at the same location of each ofthe first storage means and the second storage means; and the secondcontrol amount calculating procedure and the data for second control arestored at the same location of each of the first storage means and thethird storage means.